home-assistant / home-assistant/android
Basic auth race
Open
bug
webview
- Dominant language
- Kotlin
- Stars
- 3.9k
- Forks
- 1.1k
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 81
Description
We found out in https://github.com/home-assistant/android/pull/6750#discussion_r3163813480 that the current way we store credentials for basic auth is wrong.
It is making a key based on the ressourceURL but it can be the wrong URL.
As per the RFC 7235 §2.2 we should only use the realm and host for storage since the auth should be valid for the whole realm+host.
- We should migrate to realm+host and remove the storage of the ressourceURL
- We should inform in the changelog why we "disconnected" the basic_auth
- (Optional) migrate to encrypted password?
Contributor guide
Assessment
This issue has not been assessed yet.