Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Basic Auth: WWW-Authenticate realm param value must be quoted string #714

Closed
johakoch opened this issue Feb 10, 2023 · 0 comments · Fixed by #715
Closed

Basic Auth: WWW-Authenticate realm param value must be quoted string #714

johakoch opened this issue Feb 10, 2023 · 0 comments · Fixed by #715
Labels
bug Something isn't working
Milestone

Comments

@johakoch
Copy link
Collaborator

https://datatracker.ietf.org/doc/html/rfc2617#section-1.2:

  realm       = "realm" "=" realm-value
  realm-value = quoted-string

https://datatracker.ietf.org/doc/html/rfc7235#section-2.2:

For historical reasons, a sender MUST only generate the quoted-string
syntax.

However, Couper doesn't send the realm in quotes:

  basic_auth "ba" {
    password = "asdf"
    realm = "my realm"
  }
$ curl -si localhost:8080/
HTTP/1.1 401 Unauthorized
...
Www-Authenticate: Basic realm=my realm

config/ac_basic_auth.go:

func (b *BasicAuth) DefaultErrorHandler() *ErrorHandler {
	wwwAuthenticateValue := "Basic"
	if b.Realm != "" {
		wwwAuthenticateValue += " realm=" + b.Realm
	}
@johakoch johakoch added the bug Something isn't working label Feb 10, 2023
@johakoch johakoch linked a pull request Feb 10, 2023 that will close this issue
@johakoch johakoch modified the milestones: 1.13, 1.12.1 Feb 13, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant