ServerHttpBasicAuthenticationConverter Validates Scheme Name

Fixes: gh-5414
2018-07-31 09:05:04 -05:00
parent e3d4d66917
commit 0c26d1b98a
2 changed files with 17 additions and 1 deletions
--- a/web/src/main/java/org/springframework/security/web/server/ServerHttpBasicAuthenticationConverter.java
+++ b/web/src/main/java/org/springframework/security/web/server/ServerHttpBasicAuthenticationConverter.java
@@ -41,7 +41,7 @@ public class ServerHttpBasicAuthenticationConverter implements Function<ServerWe
 		ServerHttpRequest request = exchange.getRequest();

 		String authorization = request.getHeaders().getFirst(HttpHeaders.AUTHORIZATION);
-		if(authorization == null) {
+		if(authorization == null || !authorization.toLowerCase().startsWith("basic ")) {
 			return Mono.empty();
 		}