This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new eec218fb61 Accept multiple spaces after the Basic authentication
scheme (#1148)
eec218fb61 is described below
commit eec218fb61976bfdb7cf71ec9f59c65273e8711b
Author: Arturo Bernal <[email protected]>
AuthorDate: Fri Nov 13 15:23:21 2026 +0100
Accept multiple spaces after the Basic authentication scheme (#1148)
RFC 9110, section 11.4 defines credentials as an auth-scheme followed by
one or more space characters. The Basic parser required exactly one, so
a
request with valid credentials and more than one space after "Basic" was
rejected with a 401 response. Accept one or more spaces. A scheme that
is
not followed by a space is still rejected.
---
.../catalina/authenticator/BasicAuthenticator.java | 20 ++++++++++++-------
.../authenticator/TestBasicAuthParser.java | 23 ++++++++++++++++++----
webapps/docs/changelog.xml | 11 +++++++++++
3 files changed, 43 insertions(+), 11 deletions(-)
diff --git a/java/org/apache/catalina/authenticator/BasicAuthenticator.java
b/java/org/apache/catalina/authenticator/BasicAuthenticator.java
index 72b891b957..3c129d87c6 100644
--- a/java/org/apache/catalina/authenticator/BasicAuthenticator.java
+++ b/java/org/apache/catalina/authenticator/BasicAuthenticator.java
@@ -174,8 +174,7 @@ public class BasicAuthenticator extends AuthenticatorBase {
public static class BasicCredentials {
// the only authentication method supported by this parser
- // note: we include single white space as its delimiter
- private static final String METHOD = "basic ";
+ private static final String METHOD = "basic";
private final Charset charset;
private final boolean trimCredentials;
@@ -243,13 +242,20 @@ public class BasicAuthenticator extends AuthenticatorBase
{
}
/*
- * The authorization method string is case-insensitive and must have
exactly one space character as a delimiter.
+ * The authorization method string is case-insensitive and is followed
by one or more space characters (RFC
+ * 9110, section 11.4).
*/
private void parseMethod() throws IllegalArgumentException {
- if (authorization.startsWithIgnoreCase(METHOD, 0)) {
- // step past the auth method name
- base64blobOffset = initialOffset + METHOD.length();
- base64blobLength = authorization.getLength() - METHOD.length();
+ int end = initialOffset + authorization.getLength();
+ int pos = initialOffset + METHOD.length();
+ byte[] buffer = authorization.getBuffer();
+ if (authorization.startsWithIgnoreCase(METHOD, 0) && pos < end &&
buffer[pos] == ' ') {
+ // step past the auth method name and the space(s) that follow
it
+ while (pos < end && buffer[pos] == ' ') {
+ pos++;
+ }
+ base64blobOffset = pos;
+ base64blobLength = end - pos;
} else {
// is this possible, or permitted?
throw new
IllegalArgumentException(sm.getString("basicAuthenticator.notBasic"));
diff --git a/test/org/apache/catalina/authenticator/TestBasicAuthParser.java
b/test/org/apache/catalina/authenticator/TestBasicAuthParser.java
index 24aaa674b8..07835ccf22 100644
--- a/test/org/apache/catalina/authenticator/TestBasicAuthParser.java
+++ b/test/org/apache/catalina/authenticator/TestBasicAuthParser.java
@@ -144,14 +144,29 @@ public class TestBasicAuthParser {
}
/*
- * Confirm the Basic parser allows exactly one space after the
authentication method.
+ * RFC 9110, section 11.4: the authentication scheme is followed by one or
more space characters.
+ */
+ @Test
+ public void testAuthMethodMultipleSpaces() throws Exception {
+ final BasicAuthHeader AUTH_HEADER = new BasicAuthHeader(NICE_METHOD +
" ", USER_NAME, PASSWORD);
+ BasicAuthenticator.BasicCredentials credentials =
+ new
BasicAuthenticator.BasicCredentials(AUTH_HEADER.getHeader(),
StandardCharsets.UTF_8);
+ Assert.assertEquals(USER_NAME, credentials.getUsername());
+ Assert.assertEquals(PASSWORD, credentials.getPassword());
+ }
+
+ /*
+ * Confirm the Basic parser rejects an authentication method that is not
followed by a space character.
*/
@Test(expected = IllegalArgumentException.class)
- public void testAuthMethodExtraLeadingSpace() throws Exception {
- final BasicAuthHeader AUTH_HEADER = new BasicAuthHeader(NICE_METHOD +
" ", USER_NAME, PASSWORD);
+ public void testAuthMethodNoSpace() throws Exception {
+ final String blob = Base64.getEncoder().encodeToString((USER_NAME +
":" + PASSWORD).getBytes(StandardCharsets.ISO_8859_1));
+ final byte[] header = (NICE_METHOD +
blob).getBytes(StandardCharsets.ISO_8859_1);
+ final ByteChunk input = new ByteChunk();
+ input.setBytes(header, 0, header.length);
@SuppressWarnings("unused")
final BasicAuthenticator.BasicCredentials credentials =
- new
BasicAuthenticator.BasicCredentials(AUTH_HEADER.getHeader(),
StandardCharsets.UTF_8);
+ new BasicAuthenticator.BasicCredentials(input,
StandardCharsets.UTF_8);
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index cb7707b54f..22274f7730 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -108,6 +108,17 @@
issues do not "pop up" wrt. others).
-->
<section name="Tomcat 9.0.125 (remm)" rtext="in development">
+ <subsection name="Catalina">
+ <changelog>
+ <fix>
+ Accept one or more space characters between the authentication scheme
+ and the credentials in a <code>Basic</code> <code>Authorization</code>
+ header field, as allowed by RFC 9110, section 11.4. Previously exactly
+ one space was required. Pull request <pr>1148</pr> provided by Arturo
+ Bernal. (markt)
+ </fix>
+ </changelog>
+ </subsection>
<subsection name="Coyote">
<changelog>
<fix>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
