This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 39c5ca36f8 Accept multiple spaces after the Basic authentication
scheme (#1148)
39c5ca36f8 is described below
commit 39c5ca36f8c3c057d1e2869830d0b2a51bdf4b5c
Author: Arturo Bernal <[email protected]>
AuthorDate: Fri Nov 13 15:23:21 2026 +0100
Accept multiple spaces after the Basic authentication scheme (#1148)
RFC 9110, section 11.4 defines credentials as an auth-scheme followed by
one or more space characters. The Basic parser required exactly one, so a
request with valid credentials and more than one space after "Basic" was
rejected with a 401 response. Accept one or more spaces. A scheme that is
not followed by a space is still rejected.
---
.../catalina/authenticator/BasicAuthenticator.java | 20 ++++++++++++-------
.../authenticator/TestBasicAuthParser.java | 23 ++++++++++++++++++----
webapps/docs/changelog.xml | 6 ++++++
3 files changed, 38 insertions(+), 11 deletions(-)
diff --git a/java/org/apache/catalina/authenticator/BasicAuthenticator.java
b/java/org/apache/catalina/authenticator/BasicAuthenticator.java
index 6e39d89b2c..afcb7c817b 100644
--- a/java/org/apache/catalina/authenticator/BasicAuthenticator.java
+++ b/java/org/apache/catalina/authenticator/BasicAuthenticator.java
@@ -147,8 +147,7 @@ public class BasicAuthenticator extends AuthenticatorBase {
public static class BasicCredentials {
// the only authentication method supported by this parser
- // note: we include single white space as its delimiter
- private static final String METHOD = "basic ";
+ private static final String METHOD = "basic";
private final Charset charset;
private final ByteChunk authorization;
@@ -196,13 +195,20 @@ public class BasicAuthenticator extends AuthenticatorBase
{
}
/*
- * The authorization method string is case-insensitive and must have
exactly one space character as a delimiter.
+ * The authorization method string is case-insensitive and is followed
by one or more space characters (RFC
+ * 9110, section 11.4).
*/
private void parseMethod() throws IllegalArgumentException {
- if (authorization.startsWithIgnoreCase(METHOD, 0)) {
- // step past the auth method name
- base64blobOffset = initialOffset + METHOD.length();
- base64blobLength = authorization.getLength() - METHOD.length();
+ int end = initialOffset + authorization.getLength();
+ int pos = initialOffset + METHOD.length();
+ byte[] buffer = authorization.getBuffer();
+ if (authorization.startsWithIgnoreCase(METHOD, 0) && pos < end &&
buffer[pos] == ' ') {
+ // step past the auth method name and the space(s) that follow
it
+ while (pos < end && buffer[pos] == ' ') {
+ pos++;
+ }
+ base64blobOffset = pos;
+ base64blobLength = end - pos;
} else {
// is this possible, or permitted?
throw new
IllegalArgumentException(sm.getString("basicAuthenticator.notBasic"));
diff --git a/test/org/apache/catalina/authenticator/TestBasicAuthParser.java
b/test/org/apache/catalina/authenticator/TestBasicAuthParser.java
index ea1b1d207e..8ed102b469 100644
--- a/test/org/apache/catalina/authenticator/TestBasicAuthParser.java
+++ b/test/org/apache/catalina/authenticator/TestBasicAuthParser.java
@@ -141,14 +141,29 @@ public class TestBasicAuthParser {
}
/*
- * Confirm the Basic parser allows exactly one space after the
authentication method.
+ * RFC 9110, section 11.4: the authentication scheme is followed by one or
more space characters.
+ */
+ @Test
+ public void testAuthMethodMultipleSpaces() throws Exception {
+ final BasicAuthHeader AUTH_HEADER = new BasicAuthHeader(NICE_METHOD +
" ", USER_NAME, PASSWORD);
+ BasicAuthenticator.BasicCredentials credentials =
+ new
BasicAuthenticator.BasicCredentials(AUTH_HEADER.getHeader(),
StandardCharsets.UTF_8);
+ Assert.assertEquals(USER_NAME, credentials.getUsername());
+ Assert.assertEquals(PASSWORD, credentials.getPassword());
+ }
+
+ /*
+ * Confirm the Basic parser rejects an authentication method that is not
followed by a space character.
*/
@Test(expected = IllegalArgumentException.class)
- public void testAuthMethodExtraLeadingSpace() throws Exception {
- final BasicAuthHeader AUTH_HEADER = new BasicAuthHeader(NICE_METHOD +
" ", USER_NAME, PASSWORD);
+ public void testAuthMethodNoSpace() throws Exception {
+ final String blob = Base64.getEncoder().encodeToString((USER_NAME +
":" + PASSWORD).getBytes(StandardCharsets.ISO_8859_1));
+ final byte[] header = (NICE_METHOD +
blob).getBytes(StandardCharsets.ISO_8859_1);
+ final ByteChunk input = new ByteChunk();
+ input.setBytes(header, 0, header.length);
@SuppressWarnings("unused")
final BasicAuthenticator.BasicCredentials credentials =
- new
BasicAuthenticator.BasicCredentials(AUTH_HEADER.getHeader(),
StandardCharsets.UTF_8);
+ new BasicAuthenticator.BasicCredentials(input,
StandardCharsets.UTF_8);
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 6f60da9540..149b222e50 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -221,6 +221,12 @@
interface must implement this method. (markt)
</fix>
<!-- Entries for backport and removal before 12.0.0-M1 below this line
-->
+ <fix>
+ Accept one or more space characters between the authentication scheme
+ and the credentials in a <code>Basic</code> <code>Authorization</code>
+ header field, as allowed by RFC 9110, section 11.4. Previously exactly
+ one space was required. (abernal)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
