swagger-api / swagger-api/swagger-ui
Basic authentication header does not encode client id and client secret according to RFC6749
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 29k
- Forks
- 9.3k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 25
Description
When using the Authorization header in combination with "Content-Type": "application/x-www-form-urlencoded" does not work when the client id or client secret contains any of the following characters:
- U+0020 (SPACE)
- U+0025 (PERCENT SIGN)
- U+0026 (AMPERSAND)
- U+002B (PLUS SIGN)
- U+00A3 (POUND SIGN)
- U+20AC (EURO SIGN)
According to RFC6749 Appendix B. these characters should be encoded before base 64 encoding the auth string.
Wrong:
Raw: us€r:+password
Authorization: Basic dXPigqxyOitwYXNzd29yZA==
Correct:
Raw: us€r:+password
Encoded: us%E2%82%ACr:%2Bpassword
Authorization: Basic dXMlRTIlODIlQUNyOiUyQnBhc3N3b3Jk
In the code:
Thank you for reviewing this issue.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/core/plugins/auth/actions.js at the referenced lines and trace how the client ID and secret are combined and encoded for the Authorization header. Compare that behavior with RFC6749 Appendix B using the listed special characters. Done means the generated header matches the issue's encoded example for those characters.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authentication, frontend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100