arturobernalg opened a new pull request, #1148:
URL: https://github.com/apache/tomcat/pull/1148
RFC 9110, section 11.4 defines `credentials = auth-scheme [ 1*SP ( token68 /
#auth-param ) ]`, so the scheme may be followed by one or more spaces.
`BasicAuthenticator.BasicCredentials` required exactly one, so a request with
valid credentials and more than one space after "Basic" was rejected with a 401
response. On a running server, `Authorization: Basic dTpw` gave 401 and
`Authorization: Basic dTpw` gave 200.
The parser now skips one or more spaces. A scheme that is not followed by a
space is still rejected, and the rule for excess white space after the base64
blob is unchanged.
Note that `TestBasicAuthParser.testAuthMethodExtraLeadingSpace` asserted the
opposite ("exactly one space"), so I have replaced it with
`testAuthMethodMultipleSpaces` and added `testAuthMethodNoSpace`. The new tests
fail without the change. All of the `catalina/authenticator` tests pass.
This is a grammar conformance fix rather than a behaviour any client is
likely to depend on, so I understand if the strict parsing is preferred.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
