All,

I noticed the "scheme" regular expression in LWP::UserAgent used to match the authentication scheme sent in a WWW-Authenticate header does not match the RFC's list of allowed characters for this field.

RFC2617 uses the type "token" from RFC2616, which includes several characters not present in the "scheme" regular expression on line 344 of UserAgent.pm. I believe this regular expression should be expanded to allow the missing characters (which is quite a large list, but namely missing "." and "_").

It's only a one-line change, so I'm not sure if you'd prefer I submit a patch or just report the issue directly.

Thanks,
John

Reply via email to