Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polish BasicAuthenticationConverter

Browse Source 
This reverts to the old behavior from BasicAuthenticationFilter.
Specifically, if a token has an empty password, it still parses a username
and an empty String password.

Issue gh-7025
This commit is contained in:
Rob Winch
2019-08-02 08:14:05 -05:00
parent d157125c8e
commit ad2f999c25
2 changed files with 31 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
web/src/test/java/org/springframework/security/web/authentication/www/BasicAuthenticationConverterTests.java
View File

@@ -99,4 +99,16 @@ public class BasicAuthenticationConverterTests {
converter.convert(request);
}
@Test
public void convertWhenEmptyPassword() {
String token = "rod:";
MockHttpServletRequest request = new MockHttpServletRequest();
request.addHeader("Authorization", "Basic " + new String(Base64.encodeBase64(token.getBytes())));
UsernamePasswordAuthenticationToken authentication = converter.convert(request);
verify(authenticationDetailsSource).buildDetails(any());
assertThat(authentication).isNotNull();
assertThat(authentication.getName()).isEqualTo("rod");
assertThat(authentication.getCredentials()).isEqualTo("");
}
}