Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix encoding of Basic Auth credentials #108

Merged
merged 1 commit into from
Jun 12, 2015
Merged

Fix encoding of Basic Auth credentials #108

merged 1 commit into from
Jun 12, 2015

Conversation

rigrig
Copy link
Contributor

@rigrig rigrig commented Mar 20, 2015

Use Base64.NO_WRAP instead of Base64.DEFAULT to encode credentials.
Base64.DEFAULT adds a newline, which invalidates the header. Base64.NO_WRAP omits the newline.

This fixes #71 for me.
Now I'm wondering why it doesn't fail all the time for everybody else though.

…to encode credentials.

Base64.DEFAULT adds a newline, which invalidates the header.  Base64.NO_WRAP omits the newline.
@jalcine
Copy link

jalcine commented Mar 22, 2015

What kind of server are you using to host ownCloud? Might be something with how it handles HTTP Basic authentication.

@rigrig
Copy link
Contributor Author

rigrig commented Mar 23, 2015

I'm using Apache 2.2 on Debian 7.8 (Wheezy), nothing weird there I think.

Something I just realized though: my password is long enough that the Base64 wrapping splits the credentials into two lines. Possibly just appending a newline can be handled by the server, but having a line of garbage does make it choke.

http://tools.ietf.org/html/rfc2617#page-5 states

      basic-credentials = base64-user-pass
      base64-user-pass  = <base64 [4] encoding of user-pass,
                       except not limited to 76 char/line>
      user-pass   = userid ":" password
      userid      = *<TEXT excluding ":">
      password    = *TEXT

I'm convinced that wrapping the credentials is buggy behaviour, especially since this change makes the error go away.

@jalcine
Copy link

jalcine commented Mar 24, 2015

On Monday, March 23, 2015 11:06:47 AM Richard de Boer wrote:

I'm convinced that wrapping the credentials is buggy behaviour, especially
since this change makes the error go away.

Reading over that RFC (thanks for linking to that, I don’t see that often
😉), I agree with you.

But for compatibility’s sake, I’m curious to see if there’s a way to detect if
one ever needs to enforce the _WRAP option. Like a just a quick hash, check

and what not.

Jacky Alcine
https://jacky.wtf

@maltefiala
Copy link
Member

Will be merged during the osce days 2015 in Vienna

ramschmaerchen added a commit that referenced this pull request Jun 12, 2015
Fix encoding of Basic Auth credentials
@ramschmaerchen ramschmaerchen merged commit 25e5248 into aykit:development Jun 12, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants