Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Allow empty usernames for BasicAuth

Browse Source 
The RFCs around basic authentication don't explicitly disallow empty
usernames. On the other hand usernames containing colons are, as colons
are used to separate the username from the password.
This commit is contained in:
Norman Soetbeer
2017-10-25 21:28:07 +02:00
committed by Rob Winch
parent abe4420006
commit 4dee333a75
2 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
spring-web/src/main/java/org/springframework/http/client/support/BasicAuthorizationInterceptor.java
View File

@@ -46,9 +46,9 @@ public class BasicAuthorizationInterceptor implements ClientHttpRequestIntercept
* @param username the username to use
* @param password the password to use
*/
public BasicAuthorizationInterceptor(String username, @Nullable String password) {
Assert.hasLength(username, "Username must not be empty");
this.username = username;
public BasicAuthorizationInterceptor(@Nullable String username, @Nullable String password) {
Assert.doesNotContain(username, ":", "Username must not contain a colon");
this.username = (username != null ? username : "");
this.password = (password != null ? password : "");
}

14
spring-web/src/test/java/org/springframework/http/client/support/BasicAuthorizationInterceptorTests.java
View File

@@ -43,17 +43,17 @@ public class BasicAuthorizationInterceptorTests {
public ExpectedException thrown = ExpectedException.none();
@Test
public void createWhenUsernameIsNullShouldThrowException() {
public void createWhenUsernameContainsColonShouldThrowException() {
this.thrown.expect(IllegalArgumentException.class);
this.thrown.expectMessage("Username must not be empty");
new BasicAuthorizationInterceptor(null, "password");
this.thrown.expectMessage("Username must not contain a colon");
new BasicAuthorizationInterceptor("username:", "password");
}
@Test
public void createWhenUsernameIsEmptyShouldThrowException() throws Exception {
this.thrown.expect(IllegalArgumentException.class);
this.thrown.expectMessage("Username must not be empty");
new BasicAuthorizationInterceptor("", "password");
public void createWhenUsernameIsNullShouldUseEmptyUsername() throws Exception {
BasicAuthorizationInterceptor interceptor = new BasicAuthorizationInterceptor(
null, "password");
assertEquals("", new DirectFieldAccessor(interceptor).getPropertyValue("username"));
}
@Test