From: Brad Fitzpatrick <bradfitz@golang.org>
Date: Fri, 4 May 2018 17:16:49 +0000 (+0000)
Subject: net/http: ignore case of basic auth scheme in Request.BasicAuth
X-Git-Tag: go1.11beta1~528
X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=eed79f46c2791357a118e3f9f6be461b866e7f83;p=gostls13.git

net/http: ignore case of basic auth scheme in Request.BasicAuth

RFC 2617, Section 1.2: "It uses an extensible, case-insensitive
token to identify the authentication scheme"

RFC 7617, Section 2: "Note that both scheme and parameter names are
matched case-insensitively."

Fixes #22736

Change-Id: I825d6dbd4fef0f1c6add89f0cbdb56a03eae9443
Reviewed-on: https://go-review.googlesource.com/111516
Reviewed-by: Dmitri Shuralyov <dmitri@shuralyov.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
---

diff --git a/src/net/http/request.go b/src/net/http/request.go
index 1eb6d39067..997169ce69 100644
--- a/src/net/http/request.go
+++ b/src/net/http/request.go
@@ -858,7 +858,8 @@ func (r *Request) BasicAuth() (username, password string, ok bool) {
 // "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true).
 func parseBasicAuth(auth string) (username, password string, ok bool) {
 	const prefix = "Basic "
-	if !strings.HasPrefix(auth, prefix) {
+	// Case insensitive prefix match. See Issue 22736.
+	if len(auth) < len(prefix) || !strings.EqualFold(auth[:len(prefix)], prefix) {
 		return
 	}
 	c, err := base64.StdEncoding.DecodeString(auth[len(prefix):])
diff --git a/src/net/http/request_test.go b/src/net/http/request_test.go
index aaf9d5cb9b..7a83ae5b1c 100644
--- a/src/net/http/request_test.go
+++ b/src/net/http/request_test.go
@@ -607,6 +607,11 @@ var parseBasicAuthTests = []struct {
 	ok                         bool
 }{
 	{"Basic " + base64.StdEncoding.EncodeToString([]byte("Aladdin:open sesame")), "Aladdin", "open sesame", true},
+
+	// Case doesn't matter:
+	{"BASIC " + base64.StdEncoding.EncodeToString([]byte("Aladdin:open sesame")), "Aladdin", "open sesame", true},
+	{"basic " + base64.StdEncoding.EncodeToString([]byte("Aladdin:open sesame")), "Aladdin", "open sesame", true},
+
 	{"Basic " + base64.StdEncoding.EncodeToString([]byte("Aladdin:open:sesame")), "Aladdin", "open:sesame", true},
 	{"Basic " + base64.StdEncoding.EncodeToString([]byte(":")), "", "", true},
 	{"Basic" + base64.StdEncoding.EncodeToString([]byte("Aladdin:open sesame")), "", "", false},