Details
-
Bug
-
Resolution: Done
-
Major
-
7.4.2.GA
Description
As per RFC 7617 [1], the Basic authentication scheme should be case insensitive. However when testing with elytron, the basic authentication headers are case sensitive:
curl -k -v -H "Authorization: BASIC cXVpY2tzdGFydFVzZXI6cXVpY2tzdGFydFB3ZDEh" http://localhost:8080/servlet-security/SecuredServlet * Trying ::1:8080... * connect to ::1 port 8080 failed: Connection refused * Trying 127.0.0.1:8080... * Connected to localhost (127.0.0.1) port 8080 (#0) > GET /servlet-security/SecuredServlet HTTP/1.1 > Host: localhost:8080 > User-Agent: curl/7.76.1 > Accept: */* > Authorization: BASIC cXVpY2tzdGFydFVzZXI6cXVpY2tzdGFydFB3ZDEh > * Mark bundle as not supporting multiuse < HTTP/1.1 401 Unauthorized < Expires: 0 < Connection: keep-alive < WWW-Authenticate: Basic realm="RealmUsersRoles" < Cache-Control: no-cache, no-store, must-revalidate < Pragma: no-cache < Content-Type: text/html;charset=UTF-8 < Content-Length: 71 < Date: Thu, 20 Jan 2022 22:52:12 GMT < * Connection #0 to host localhost left intact <html><head><title>Error</title></head><body>Unauthorized</body></html>
curl -k -v -H "Authorization: Basic cXVpY2tzdGFydFVzZXI6cXVpY2tzdGFydFB3ZDEh" http://localhost:8080/servlet-security/SecuredServlet * Trying ::1:8080... * connect to ::1 port 8080 failed: Connection refused * Trying 127.0.0.1:8080... * Connected to localhost (127.0.0.1) port 8080 (#0) > GET /servlet-security/SecuredServlet HTTP/1.1 > Host: localhost:8080 > User-Agent: curl/7.76.1 > Accept: */* > Authorization: Basic cXVpY2tzdGFydFVzZXI6cXVpY2tzdGFydFB3ZDEh > * Mark bundle as not supporting multiuse < HTTP/1.1 200 OK < Expires: 0 < Connection: keep-alive < Cache-Control: no-cache, no-store, must-revalidate < Pragma: no-cache < Content-Length: 230 < Date: Thu, 20 Jan 2022 22:52:33 GMT < <html><head><title>servlet-security</title></head><body> <h1>Successfully called Secured Servlet </h1> <p>Principal : quickstartUser</p> <p>Remote User : quickstartUser</p> <p>Authentication Type : BASIC</p> </body></html>
Attachments
Issue Links
- is incorporated by
-
JBEAP-22973 (7.4.z) Upgrade Elytron from 1.15.9.Final-redhat-00001 to 1.15.11.Final-redhat-00002
-
- Closed
-
