Error in basic-auth authorization

[nico-acidtango]

Summary

Error creating and using credentials in basic-auth with passwords that contain ':' characters.

Assumptions and general info

• Kong version 0.11.0
• Assume we have a consumer with consumer-id 060be9b3-cc9d-4e74-9d39-ff227581a20b

Steps To Reproduce

1. Create a credential with password containing ':'

$ curl -X POST http://kong:8001/consumers/060be9b3-cc9d-4e74-9d39-ff227581a20b/basic-auth \
    --data "username=test" \
    --data "password=s43_Pos:bwUV5E"

2. Try to use it in an api, proxying to httpbin

curl --user test http://localhost:8080/test

3. Check user is not authenticated in the response. In my case, it is sent with anonymous headers.

Additional Details & Logs

The problem as far as I could see browsing the code is that the authorization header is being split using ':' and only the first two part are used (first part is considered user, and second part is the password) effectively discarding parts of the password.

kong/kong/plugins/basic-auth/access.lua

Line 42 in 777b667

local basic_parts = utils.split(decoded_basic, ":")

[thibaultcha]

Hi @nico-acidtango ! Thank you for the report. We would welcome a PR to fix this, if you are willing to give it a stab!

[nico-acidtango]

Hi @thibaultcha ! I think I can handle it, and I'm happy to help. I'll get to it as soon as possible.

[chenyukang]

Nice work!
I also have a question for basic-auth,
how to specify the username for basic-auth?
Suppose i have tow consumers, and generate basic auth key separately with:

user1 -> password1
user2 -> password2

now when enable the basic-auth for an API, since there is no options to specify username,
both user1 and user2 with correct password will processed successfully.

@thibaultcha

[chenyukang]

@nico-acidtango
you said: 'Password containing '%'' is not processed correctly,
but PR is fix ':', did I miss something?

[nico-acidtango]

@chenyukang you are right, I forgot to mention that the password containing '%' part was my mistake for not url encoding that part of the password when making the request, I found out writing the tests...

I'll edit the issue