Skip to content
This repository has been archived by the owner on Sep 12, 2021. It is now read-only.

BasicAuthProvider should check the method is Basic #337

Merged
merged 1 commit into from
May 5, 2015

Conversation

cemcatik
Copy link
Contributor

@cemcatik cemcatik commented May 5, 2015

I ran across this issue when I send requests where the Authorization header was a JWT Bearer such as:

Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJlNGU1N2Y1NzJhMGU4MjRjMGQxYjZhMzIzMzIxNmUzMmZhYjBiNzMyNDdmNzY3MTBkMmM1OGE2OTEwODA4MmYzZDJlYTVlYTk1YjA0YTA2NjgzM2FjMzU0ZDQwYjk3Y2UxMTE0ZmUyNWNmMjEzYjJkYzllOTAzOWQ0NjQ1OGQ1YyIsImlzcyI6InBsYXktc2lsaG91ZXR0ZSIsImV4cCI6MTQzMDg0NTMxMSwiaWF0IjoxNDMwODAyMTExLCJqdGkiOiJmN2Y1ZThjNmE1MjliYTlkZGYwNjViZjQ5ZGY0MDVjYjQ1ZWEyNmQ3ZTc3NDI5M2Y3NGFhZWVjNTU0ODg1MTVmNTYzMzM5MTM4OGQzY2I3ODA0ZmM4MDIzZjU4ODMzYjk3OGUyMmUxYTZmYzdmNmVkZDJjN2Y5NTVjNDJkM2ZjYTQ2MzVlODZlMzliZjVmZWJjMmI0MzliNzQ2MDU1YzllZjc1ZWFmNzc2MzMxZGU1Yjg4ZmQwMGNhY2U2MjJjZDk0YWMzMzIzNzhkNjNmOTNjZjhkZDUzZGUzODdjYWJiNTgzYTMzYTFjMDIwYjY5MjQ2YTc0MGNhOTY3NDg5ZTRjIn0.mWXfWsFomqMnMBHgZUoHNTONmAbrKoUIpG5stzrjNHo

When the BasicAuthProvider tries to parse the credentials it Base64 decodes "Bearer eyJ0eXAiOiJKV1Q..." and since the resulting string has a : in it thinks it's a Basic Auth header. This PR makes sure the header is Basic Auth and returns None otherwise.

akkie added a commit that referenced this pull request May 5, 2015
BasicAuthProvider should check the method is Basic
@akkie akkie merged commit 0eca774 into mohiva:master May 5, 2015
@akkie
Copy link
Contributor

akkie commented May 5, 2015

Thanks!

@cemcatik
Copy link
Contributor Author

cemcatik commented May 5, 2015

Any time

@cemcatik cemcatik deleted the basic branch May 5, 2015 07:44
@cemcatik cemcatik restored the basic branch May 5, 2015 07:45
@cemcatik cemcatik deleted the basic branch May 5, 2015 07:45
@akkie akkie added this to the 3.0 milestone May 20, 2015
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
2 participants