开发者

Password with a colon fails basic auth?

I'm using basic auth. If my password contains a colon, I seem to get a failure to authenticate. Are colons not allowed in a password? How I'm authenticating:

DefaultHttpClient client = new DefaultHttpClient();
HttpRequestInterceptor preemptiveAuth = new HttpRequestInterceptor() {
    ...
};
client.addRequestInterceptor(preemptiveAuth, 0);
client.getCredentialsProvider().setCredentials(
  new AuthScope("example.com", 443),
  new UsernamePasswordCredentia开发者_StackOverflow社区ls("me", "password:test"));

Passwords without a colon always work. Passwords with a colon always fail. Do I have to escape the password somehow before handing it to the UsernamePasswordCredentials class constructor? I know basicauth uses the username/password separated by a colon, then base64 encoded, is that what the problem is here?

Thanks

---- Update ------

Thanks all, yes was a problem in the server I was communicating with!


It should work. RFC2617 is the RFC around HTTP authentication. The spec does not place any restriction on the characters used within a password, only on the username;

To receive authorization, the client sends the userid and password, separated by a single colon (":") character, within a base64 [7] encoded string in the credentials.

  basic-credentials = base64-user-pass
  base64-user-pass  = <base64 [4] encoding of user-pass,
                      except not limited to 76 char/line>
  user-pass   = userid ":" password
  userid      = *<TEXT excluding ":">
  password    = *TEXT


If the server has a bug in separating that Base64 "username:password", the authentication method will fail. Either check on your server (perhaps there are updates available? go with a different server?), don't use a colon in your passwords, or use a different authentication method.

Out of curiosity, what server are you trying to authenticate against?


I know this is an old post, but in case others run into the same issue:

The code in new UsernamePasswordCredentials("me", "password:test")); might split the string on every colon. Here is an example in PHP that would fail:

 $bits = explode(':',$auth_string);
 $user = $bits[0];
 $password = $bits[1];

Here is a fix:

 $bits = explode(':',$auth_string);
 $user = array_shift($bits);
 $password = implode(':',$bits);


Just had an issue with a colon in the password. Seems like the username and password won't be splitted correctly.

Example user:pass:word

In my case the delivered Password in PHP was just "pass" instead of "pass:word".

I've learned to avoid special chars like : (colon) and @ (at) in the password. It's a bit strange, because the same logic worked correctly before we've updated to php-fpm (I don't know if this issue belongs to php-fpm).

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜