TEST_CODEOWNERS/rails
3
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Merge pull request #43209 from mpestov/check-basic-auth-credentials

Browse Source 
Check basic auth credentials before authenticate
This commit is contained in:
Rafael França 2021-09-20 18:13:14 -04:00 committed by GitHub
commit 20db0845cd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
actionpack/lib/action_controller/metal/http_authentication.rb
View File

@ -103,7 +103,7 @@ def authenticate(request, &login_procedure)
end
def has_basic_credentials?(request)
request.authorization.present? && (auth_scheme(request).downcase == "basic")
request.authorization.present? && (auth_scheme(request).downcase == "basic") && user_name_and_password(request).length == 2
end
def user_name_and_password(request)

5
actionpack/test/controller/http_basic_authentication_test.rb
View File

@ -112,6 +112,11 @@ def test_encode_credentials_has_no_newline
assert_no_match(/\n/, result)
end
test "has_basic_credentials? should fail with credentials without colon" do
@request.env["HTTP_AUTHORIZATION"] = "Basic #{::Base64.encode64("David Goliath")}"
assert_not ActionController::HttpAuthentication::Basic.has_basic_credentials?(@request)
end
test "successful authentication with uppercase authorization scheme" do
@request.env["HTTP_AUTHORIZATION"] = "BASIC #{::Base64.encode64("lifo:world")}"
get :index