HTTP Authorization Manager: Colon in Username is not rejected for BASIC_DIGEST
Open
os: All
P2
- Dominant language
- Java
- Stars
- 9.5k
- Forks
- 2.3k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 5
Description
**marius.spix** ([Bug 61622](https://bz.apache.org/bugzilla//show_bug.cgi?id=61622&redirect=false)):
RFC 2617 does not allow usernames which include a colon ':', however, the HTTP Authorization Manager does. This causes creation of nonsense Authorization headers, as all parts of the username after the first colon are interpreted as part of the password.
The HTTP Authorization Manager should reject usernames with a colon.
JMeter Version: 3.3 r1808647
Severity: normal
OS: All
Contributor guide
Assessment
This issue has not been assessed yet.