spring-projects / spring-projects/spring-data-mongodb
Tweak and correct documentation related to username/password URI-encoding.
@christophstrobl is already working on this.
Since Apr 17, 2023.
- Dominant language
- Java
- Stars
- 1.7k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
The Spring Boot Data MongoDB documentation says:
Username and password credentials used in XML-based configuration must be URL-encoded when these contain reserved characters, such as
:,%,@, or,. The following example shows encoded credentials:m0ng0@dmin:mo_res:bw6},Qsdxx@admin@database→m0ng0%40dmin:mo_res%3Abw6%7D%2CQsdxx%40admin@databaseSee section 2.2 of RFC 3986 for further details.
However § 2.2 is referring to general delimiters as well as "sub-delimiters" that may or may not be restricted based upon individual URI-components. In RFC 3986 § 3.2.1. User Information you can see that username/password data isn't so limited, and can actually contain: sub-delims from § 2.2.
userinfo = *( unreserved / pct-encoded / sub-delims / ":" )
Thus it would seem that of the reserved characters only gen-delims are excluded:
gen-delims = ":" / "/" / "?" / "#" / "[" / "]" / "@"
Therefore only the following delimiters must be URI-encoded in the username or password components: %, :, /, ?, #, [, ], @.
Nowhere in RFC 3986 can I find any indication that characters such as comma , are restricted in the username or password components. Let me know if I missed that.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.