imbajin commented on code in PR #3096:
URL: https://github.com/apache/hugegraph/pull/3096#discussion_r3610229026
##########
hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/auth/WsAndHttpBasicAuthHandler.java:
##########
@@ -103,28 +107,21 @@ public void channelRead(ChannelHandlerContext ctx, Object
msg) {
return;
}
- // strip off "Basic " from the Authorization header (RFC 2617)
- final String basic = "Basic ";
final String header = request.headers().get("Authorization");
- if (!header.startsWith(basic)) {
- sendError(ctx, msg);
- return;
- }
- byte[] userPass = null;
- try {
- final String encoded = header.substring(basic.length());
- userPass = this.decoder.decode(encoded);
- } catch (IndexOutOfBoundsException iae) {
- sendError(ctx, msg);
- return;
- } catch (IllegalArgumentException iae) {
- sendError(ctx, msg);
- return;
- }
- String authorization = new String(userPass,
- StandardCharsets.UTF_8);
- String[] split = authorization.split(":");
- if (split.length != 2) {
+ final Map<String, String> credentials = new HashMap<>();
+ if (header.startsWith(BASIC_AUTH_PREFIX)) {
Review Comment:
Fixed the standards issue for Basic by parsing the scheme separately and
comparing it case-insensitively. Bearer handling on the internal Gremlin HTTP
endpoint has been removed from this PR; Bearer remains on the public REST API
to avoid duplicate authentication.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
