SEC-1446: Malformed Base64 in Basic Authentication header causes BasicAuthenticationFilter to throw a RuntimeException #1679

Closed
spring-issuemaster opened this Issue Mar 20, 2010 · 2 comments

1 participant

@spring-issuemaster

Hugh Winkler (Migrated from SEC-1446) said:

Since Base64.decode throws a RuntimeException if it detects bad characters in the input string, org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilter throws the RTE if the Authentication header contains malformed base 64. The effect is that http servers return 500 rather than 401.

My fix just adds an additional check by calling Base64.isBase64, and if that fails, continues processing as if the Authentication header were missing.

@spring-issuemaster

Luke Taylor said:

Converted patch to attachment.

@spring-issuemaster

Luke Taylor said:

I've made changes to treat an invalid header (either bad Base64 or an invalid token) as an authentication failure, which will generally result in the authentication entry point being invoked. Using Base64.isBase64() just decodes the encoded string an additional time which will not be necessary in most cases, so I've elected to trap the exception raised when the characters are invalid instead, throwing BadCredentialsException.

@spring-issuemaster spring-issuemaster added this to the 3.1.0.M1 milestone Feb 5, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment