UrlEncoded username password are not decoded when adding them as basic authentication. #1037
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Decode username/password before converting them to base64-string; otherwise, the authentication will fail if you have example @ included in the password (@ is encoded as %40)
|
@Tasteful excellent, excellent catch. Your timing is perfect as well since we just opened #1035 which introduces some improvements to the basic auth API. Unfortunately though, it doesn't make sense to merge this PR since the code has changed quite a bit in #1035. I've incorporated your change in this commit: 20de56f I'm confused though as to why you are un-escaping the username and password individually. Wouldn't just |
|
I'm not sure if colon (:) can break the unescape of the string in some way/cases. If that is a 'safe' character everything can be unescaped in one place. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
UrlDecode username/password before converting them to base64-string, otherwise; the authentication will fail if you have special characters (example @) included in the password (@ is encoded as %40).
The encoded value will be included in the base64-characters string instead of the clear-text version (UrlDecoded).