From eed79f46c2791357a118e3f9f6be461b866e7f83 Mon Sep 17 00:00:00 2001 From: Brad Fitzpatrick Date: Fri, 4 May 2018 17:16:49 +0000 Subject: [PATCH] net/http: ignore case of basic auth scheme in Request.BasicAuth RFC 2617, Section 1.2: "It uses an extensible, case-insensitive token to identify the authentication scheme" RFC 7617, Section 2: "Note that both scheme and parameter names are matched case-insensitively." Fixes #22736 Change-Id: I825d6dbd4fef0f1c6add89f0cbdb56a03eae9443 Reviewed-on: https://go-review.googlesource.com/111516 Reviewed-by: Dmitri Shuralyov Reviewed-by: Brad Fitzpatrick --- src/net/http/request.go | 3 ++- src/net/http/request_test.go | 5 +++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/src/net/http/request.go b/src/net/http/request.go index 1eb6d39067..997169ce69 100644 --- a/src/net/http/request.go +++ b/src/net/http/request.go @@ -858,7 +858,8 @@ func (r *Request) BasicAuth() (username, password string, ok bool) { // "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true). func parseBasicAuth(auth string) (username, password string, ok bool) { const prefix = "Basic " - if !strings.HasPrefix(auth, prefix) { + // Case insensitive prefix match. See Issue 22736. + if len(auth) < len(prefix) || !strings.EqualFold(auth[:len(prefix)], prefix) { return } c, err := base64.StdEncoding.DecodeString(auth[len(prefix):]) diff --git a/src/net/http/request_test.go b/src/net/http/request_test.go index aaf9d5cb9b..7a83ae5b1c 100644 --- a/src/net/http/request_test.go +++ b/src/net/http/request_test.go @@ -607,6 +607,11 @@ var parseBasicAuthTests = []struct { ok bool }{ {"Basic " + base64.StdEncoding.EncodeToString([]byte("Aladdin:open sesame")), "Aladdin", "open sesame", true}, + + // Case doesn't matter: + {"BASIC " + base64.StdEncoding.EncodeToString([]byte("Aladdin:open sesame")), "Aladdin", "open sesame", true}, + {"basic " + base64.StdEncoding.EncodeToString([]byte("Aladdin:open sesame")), "Aladdin", "open sesame", true}, + {"Basic " + base64.StdEncoding.EncodeToString([]byte("Aladdin:open:sesame")), "Aladdin", "open:sesame", true}, {"Basic " + base64.StdEncoding.EncodeToString([]byte(":")), "", "", true}, {"Basic" + base64.StdEncoding.EncodeToString([]byte("Aladdin:open sesame")), "", "", false}, -- 2.51.0