Skip to content

Fix HTTP auth password encoding #302

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 7, 2016
Merged

Conversation

adrienverge
Copy link
Contributor

Username/password encoding in HTTP basic auth is currently broken for non-ASCII password.

Example with user user and password unusual-char-é. With curl it works as expected:

curl -v http://user:unusual-char-%C3%A9@localhost:5984/
> GET / HTTP/1.1
> Authorization: Basic YWxpY2U6YWRyaWVuPTohw6k=
>
< HTTP/1.1 200 OK

But with couchdb-python the string is decoded from utf-8 then re-encoded into latin1, causing an incorrect Authorization header:

url = 'http://user:unusual-char-%C3%A9@localhost:5984/'
couchdb.Server(url).version()
> GET / HTTP/1.1
> Authorization: Basic dXNlcjp1bnVzdWFsLWNoYXIt6Q==
>
< HTTP/1.1 401 Unauthorized

This patch fixes this wrong encoding charset by using utf-8 (used by default by CouchDB) instead of latin1.

Closes: #301

Username/password encoding in HTTP basic auth is currently broken for
non-ASCII password.

Example with user `user` and password `unusual-char-é`. With curl it
works as expected:

```shell
curl -v http://user:unusual-char-%C3%A9@localhost:5984/
```

```
> GET / HTTP/1.1
> Authorization: Basic YWxpY2U6YWRyaWVuPTohw6k=
>
< HTTP/1.1 200 OK
```

But with couchdb-python the string is decoded from `utf-8` then
re-encoded into `latin1`, causing an incorrect Authorization header:

```python
url = 'http://user:unusual-char-%C3%A9@localhost:5984/'
couchdb.Server(url).version()
```

```
> GET / HTTP/1.1
> Authorization: Basic dXNlcjp1bnVzdWFsLWNoYXIt6Q==
>
< HTTP/1.1 401 Unauthorized
```

This patch fixes this wrong encoding charset by using `utf-8` (used by
default by CouchDB) instead of `latin1`.

Closes: djc#301
@djc
Copy link
Owner

djc commented Sep 7, 2016

Good stuff, thanks!

@djc djc merged commit 370a5b9 into djc:master Sep 7, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

HTTP basic auth is broken for accented characters
2 participants