Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

basic auth error #456

Closed
komuw opened this issue Jun 16, 2024 · 2 comments · Fixed by #457
Closed

basic auth error #456

komuw opened this issue Jun 16, 2024 · 2 comments · Fixed by #457

Comments

@komuw
Copy link
Owner

komuw commented Jun 16, 2024

When you use an empty hint, basic auth middleware returns;
www-authenticate: Basic realm=enter username and password:

This works okay on desktop browsers but doesn't on mobile

@komuw
Copy link
Owner Author

komuw commented Jun 16, 2024

ong/middleware/auth.go

Lines 10 to 20 in c1fb100

// BasicAuth is a middleware that protects wrappedHandler using basic authentication.
func BasicAuth(wrappedHandler http.Handler, user, passwd, hint string) http.HandlerFunc {
if err := key.IsSecure(passwd); err != nil {
panic(err)
}
// See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/WWW-Authenticate
realm := `enter username and password: ` + hint
e := func(w http.ResponseWriter) {
errMsg := `Basic realm=` + realm
w.Header().Set("WWW-Authenticate", errMsg)

@komuw
Copy link
Owner Author

komuw commented Jun 16, 2024

Even when a hint is not empty, it fails on mobile;
www-authenticate: Basic realm=enter username and password: hint

komuw added a commit that referenced this issue Jun 16, 2024
- This was failing in mobile browsers. They were unable to show the username/password popup.
  I suspect that those clients only expect a header of the form `www-authenticate: Basic realm=realmStr`. 
  Where `realmStr` is a string with no special characters. The docs say that `realmStr` is any string whose character set is `us-ascii`. The `:` colon symbol is part of us-ascii(number 58). So I don't know why it would cause mobile clients to fail.
- Fixes: #456
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/WWW-Authenticate#realm
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant