🧹 chore: Enhance BasicAuth middleware to better comply with RFC 6750 #3484
Conversation
|
Warning Rate limit exceeded@gaby has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 21 minutes and 26 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (1)
WalkthroughThe BasicAuth middleware was updated for improved robustness in parsing the Authorization header, with enhanced validation and whitespace handling. The default unauthorized response now uses a properly quoted and capitalized Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant BasicAuthMiddleware
participant Handler
Client->>BasicAuthMiddleware: HTTP request with Authorization header
BasicAuthMiddleware->>BasicAuthMiddleware: Trim & split Authorization header
alt Valid "Basic" scheme and credentials
BasicAuthMiddleware->>Handler: Forward request
Handler-->>BasicAuthMiddleware: Response (e.g., 418)
BasicAuthMiddleware-->>Client: Response from handler
else Invalid or missing credentials
BasicAuthMiddleware-->>Client: 401 Unauthorized with WWW-Authenticate header
end
Possibly related PRs
Suggested reviewers
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Pull Request Overview
This PR enhances the BasicAuth middleware by improving header parsing and formatting while adding tests for additional scenarios and updating documentation.
- The WWW-Authenticate header now correctly quotes the realm parameter using strconv.Quote.
- Header parsing in the middleware has been tightened by trimming whitespace and splitting the authorization header into tokens.
- New tests have been added to validate handling of whitespace and the proper error response with invalid headers.
Reviewed Changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| middleware/basicauth/config.go | Updates the WWW-Authenticate header to include a quoted realm value. |
| middleware/basicauth/basicauth.go | Refines header parsing by trimming whitespace and tokenizing the header. |
| middleware/basicauth/basicauth_test.go | Adds tests for BasicAuth header value variations and whitespace handling. |
| docs/middleware/basicauth.md | Documents the default challenge header update. |
gaby
changed the title
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #3484 +/- ##
==========================================
+ Coverage 83.71% 83.76% +0.05%
==========================================
Files 120 120
Lines 12253 12254 +1
==========================================
+ Hits 10258 10265 +7
+ Misses 1568 1564 -4
+ Partials 427 425 -2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
gaby
changed the title
Summary
realmparameter inWWW-Authenticateheader