Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Change basic authentication to use UTF-8

See original GitHub issue

At the moment, BasicCredentials use ISO 8859-1 charset, which would break authentication if, say, a password contains a character not present in that charset.

RFC 7617 outlines support for UTF-8 in basic authentication scheme. The short of it is, that in an older RFC the charset was left unspecified by mistake, so handling of non-ASCII characters was non-standard. Now the server can choose to declare its support for UTF-8 via the charset auth-param, and the client can choose to use it. See appendix B for ways to provide some backward compatibility.

Issue Analytics

State:
Created 3 years ago
Reactions:2
Comments:5 (2 by maintainers)

Top GitHub Comments

1reaction

ashwinbhaskarcommented, Jun 29, 2020

I can pick this up. @rossabaker If it’s okay, can you assign this to me?

0reactions

rossabakercommented, Jul 4, 2020

Yes, it makes sense to me to parameterize that.

Top Results From Across the Web

What encoding should I use for HTTP Basic Authentication?

The reason for this choice I believe is that UTF-8 is capable of encoding all possible characters, while ISO-8859-1 (or ASCII) is not....

A Basic authentication module that uses UTF-8 to encode ...

A Basic authentication module that uses UTF-8 to encode username and password (rather than ANSI for the built-in ... Change it to use...

Change Basic authentication request header username and ...

Change Basic authentication request header username and password character encoding to UTF-8 (used to be ISO-8859-1)

An Encoding Parameter for HTTP Basic Authentication draft ...

In the first authentication request, choose the character encoding based on the user's credentials: if they do not need any characters outside the...

Unicode username & password - Google Groups

convert the username/password strings to UTF-8 before calling ... sounds like it's not safe to use unicode for basic or digest authentication credentials....