-
Notifications
You must be signed in to change notification settings - Fork 70
Open
Description
RFC 9110 defines the field value of the Authorization header as:
Authorization = credentials
credentials = auth-scheme [ 1*SP ( token68 / #auth-param ) ]
which, according to RFC 5234 — ABNF, means there can be one or more spaces between the auth-scheme and token68.
3.6. Variable Repetition: *Rule
The operator "*" preceding an element indicates repetition. The full
form is:
<a>*<b>element
where <a> and <b> are optional decimal values, indicating at least
<a> and at most <b> occurrences of the element.
Default values are 0 and infinity so that *<element> allows any
number, including zero; 1*<element> requires at least one;
3*3<element> allows exactly 3; and 1*2<element> allows one or two.
Lines 64 to 70 in 05bb4d7
| // Parsing authorization header. | |
| parseAuthorization(header) { | |
| if (basicSchemeRegExp.test(header)) { | |
| let tokens = header.split(" "); | |
| return tokens[1]; | |
| } | |
| } |
Your parser assumes the 1*SP part to be a single space, , and fails to parse the valid credentials,
Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
erroneously returning "".
Metadata
Metadata
Assignees
Labels
No labels