Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Passwords containing ':' are not read properly #41

Open
Cybolic opened this issue Nov 20, 2014 · 5 comments
Open

Passwords containing ':' are not read properly #41

Cybolic opened this issue Nov 20, 2014 · 5 comments

Comments

@Cybolic
Copy link

Cybolic commented Nov 20, 2014

Since userid and password are read as index 0 and 1 of credentials.split(':') the remaining part of the password after ':' is discarded.
@Cybolic Cybolic mentioned this issue Nov 20, 2014
Open
@lordgraysith
Copy link

So... over a year and nobody else seems to care about this? This is tripping us up. Can we please merge the PR? #42

@lordgraysith
Copy link

For anybody else who needs to fix this now, just URL encode your password on the client and then decode it on the server. Maybe we should suggest that in the docs?

@fisch3r
Copy link

fisch3r commented Nov 24, 2016

go and merge!

@matzetronic
Copy link

Please merge #42 - this is a blocker for us, thanks!

MatthiasKunnen added a commit to MatthiasKunnen/passport-http-2 that referenced this issue Dec 20, 2018
@MatthiasKunnen
Corrected handling of HTTP Basic edge cases
4cc025a 
Previous implementation:
empty user-pass  -> error basic realm
no " " separator -> error 400
no : separator   -> error basic realm
empty password   -> error basic realm
empty username   -> error basic realm

New implementation:
empty user-pass  -> error 400
no " " separator -> error 400
no : separator   -> error 400
empty password   -> success
empty username   -> success

Also fixed passwords containing ':' being truncated.

This fixes:
- jaredhanson/passport-http#20
- jaredhanson/passport-http#41
- jaredhanson/passport-http#42
- jaredhanson/passport-http#63
- jaredhanson/passport-http#78

The new implemementation complies with
https://tools.ietf.org/html/rfc2617#section-2.
MatthiasKunnen added a commit to MatthiasKunnen/passport-http-2 that referenced this issue Dec 20, 2018
@MatthiasKunnen
Corrected handling of HTTP Basic edge cases
da58b3a 
Previous implementation:
empty user-pass  -> error basic realm
no " " separator -> error 400
no : separator   -> error basic realm
empty password   -> error basic realm
empty username   -> error basic realm

New implementation:
empty user-pass  -> error 400
no " " separator -> error 400
no : separator   -> error 400
empty password   -> success
empty username   -> success

Also fixed passwords containing ':' being truncated.

This fixes:
- jaredhanson/passport-http#20
- jaredhanson/passport-http#41
- jaredhanson/passport-http#42
- jaredhanson/passport-http#63
- jaredhanson/passport-http#78

The new implemementation complies with
https://tools.ietf.org/html/rfc2617#section-2.
@ebaynaud
Copy link

Duplicate of #20

AaronDewes pushed a commit to AaronDewes/modern-passport-http that referenced this issue Feb 6, 2021
@MatthiasKunnen @AaronDewes
Changes from http-passport-2
76779d6 
This is mostly the following change:

Corrected handling of HTTP Basic edge cases

Previous implementation:
empty user-pass  -> error basic realm
no " " separator -> error 400
no : separator   -> error basic realm
empty password   -> error basic realm
empty username   -> error basic realm

New implementation:
empty user-pass  -> error 400
no " " separator -> error 400
no : separator   -> error 400
empty password   -> success
empty username   -> success

Also fixed passwords containing ':' being truncated.

This fixes:
- jaredhanson#20
- jaredhanson#41
- jaredhanson#42
- jaredhanson#63
- jaredhanson#78

The new implemementation complies with
https://tools.ietf.org/html/rfc2617#section-2.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@fisch3r @Cybolic @matzetronic @ebaynaud @lordgraysith