imbajin commented on code in PR #3290:
URL: https://github.com/apache/hugegraph/pull/3290#discussion_r4240998973
##########
hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/filter/AuthenticationFilter.java:
##########
@@ -184,19 +184,16 @@ protected User authenticate(ContainerRequestContext
context) {
if (auth.startsWith(BASIC_AUTH_PREFIX)) {
auth = auth.substring(BASIC_AUTH_PREFIX.length());
- // TODO: decode the Basic credential as UTF-8 and split it on the
first colon only.
- // Decoding as ASCII and splitting on every colon makes a
non-ASCII password answer
- // 401 and a password containing ':' answer 400, although both
were accepted at
- // account creation. The Helm chart (helm/hugegraph) refuses such
admin passwords in
- // its schema and Server wrapper; drop that guard once this is
fixed.
- auth = new String(DatatypeConverter.parseBase64Binary(auth),
Charsets.ASCII_CHARSET);
- String[] values = auth.split(":");
- if (values.length != 2) {
+ // RFC 7617 section 2.1 allows only UTF-8 as the declared charset,
and it bars a
+ // colon from the user-id alone, so split on the first one and
keep the rest
+ auth = new String(DatatypeConverter.parseBase64Binary(auth),
StandardCharsets.UTF_8);
Review Comment:
⚠️ Blocking: no. Summary: Both Basic-auth parsers now unconditionally decode
credentials as UTF-8, but the 401 paths do not advertise `charset="UTF-8"`; the
PR also notes that Jersey and OkHttp clients still send ISO-8859-1. Those
clients cannot infer the new encoding and continue returning 401 for non-ASCII
passwords. Please advertise the expected charset in the Basic
`WWW-Authenticate` challenge for both entry points, add a response-level
regression, and document any remaining client limitations. Evidence: [RFC 7617
section 2.1](https://www.rfc-editor.org/rfc/rfc7617#section-2.1) defines the
challenge charset parameter as the signal for the expected encoding; the
exact-head `AuthenticationFilter` and `CypherAPI` 401 paths do not include it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
