fix: reject colonless Basic-auth credentials (RFC 7617 compliance) by francisjohnjohnston-web · Pull Request #1393 · h3js/h3

francisjohnjohnston-web · 2026-05-24T15:52:01Z

Bug

requireBasicAuth silently authenticates colonless credentials.

When a credential string has no : separator, indexOf(":") returns -1. The subsequent slices become:

authDecoded.slice(0, -1) → trims the last character (e.g. "admins" → "admin")
authDecoded.slice(0) → the full string ("admins")

So the colonless credential "admins" mis-parses into username="admin" / password="admins". If the server has { username: "admin", password: "admins" } configured, the malformed credential authenticates successfully.

Fix

Reject immediately when colonIndex === -1. RFC 7617 §2 defines the format as user-id ":" password; a missing colon is an unconditionally invalid credential.

const colonIndex = authDecoded.indexOf(":");
if (colonIndex === -1) {
  throw authFailed(event, opts?.realm);   // ← added
}

Test

Added a regression test that sends Basic base64("admins") against a server configured with { username: "admin", password: "admins" }. Before this fix the test returned 200; after it returns 401.

All 36 existing auth tests pass.

Summary by CodeRabbit

Bug Fixes
- Enhanced Basic authentication validation to strictly enforce proper credential formatting standards, preventing potential misinterpretation of malformed authentication requests.

A colonless decoded credential made indexOf(":") return -1, so slice(0, -1) / slice(0) split e.g. "admins" into user="admin", pass="admins". With matching config this authenticated a malformed credential. Reject when no colon is present (RFC 7617).

coderabbitai · 2026-05-24T15:52:11Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c66fa485-b793-46a7-aa11-84ea9bcd7f36

📥 Commits

Reviewing files that changed from the base of the PR and between 84244b4 and 68ba086.

📒 Files selected for processing (2)

src/utils/auth.ts
test/auth.test.ts

📝 Walkthrough

Walkthrough

The pull request adds explicit validation to the Basic authentication handler to reject credentials lacking the required RFC 7617 colon delimiter. The implementation adds an early check in requireBasicAuth, and a regression test verifies that colonless credentials are correctly rejected with a 401 response.

Changes

Basic Auth Colon Delimiter Validation

Layer / File(s)	Summary
Colon delimiter validation and test `src/utils/auth.ts`, `test/auth.test.ts`	`requireBasicAuth` adds an explicit check rejecting decoded Basic credentials that lack the required colon separator; a test case confirms colonless inputs (e.g., `"admins"`) are rejected with status 401 rather than mis-parsed.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

h3js/h3#1283: Prior changes to requireBasicAuth validation and error handling for malformed Basic auth credentials.

Poem

🐰 A colon was lost in the auth domain,
So strict validation took the reign!
Now user:pass must be plain,
Coronless creds? They're in vain! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: fixing rejection of colonless Basic-auth credentials to comply with RFC 7617, which directly matches the core fix in the changeset.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint skipped: no ESLint configuration detected in root package.json. To enable, add eslint to devDependencies.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

pi0x

Note: this review was performed by AI agents (Claude Code) on behalf of the maintainer, in two independent passes.

Pass 1 reviewed the diff for correctness, edge cases, and test coverage. Pass 2 (a fresh agent, adversarial by design) independently re-read the diff, checked for merge conflicts/CI status, and tried to find a reason to block approval before this review was posted. Both passes agree this change is correct, adequately tested, and safe to merge.

Caveat: this repo's real CI workflow (lint + build + vitest) requires maintainer approval to run on fork PRs and has not executed on this PR yet — only automated third-party checks (CodeRabbit, Socket Security) have run. Please trigger/approve the CI workflow before merging.

pi0

thanks!

francisjohnjohnston-web requested a review from pi0 as a code owner May 24, 2026 15:52

pi0x approved these changes Jul 2, 2026

View reviewed changes

Merge branch 'main' into fix/basic-auth-no-colon-bypass

053fa18

pi0 approved these changes Jul 2, 2026

View reviewed changes

pi0 merged commit 89012f7 into h3js:main Jul 2, 2026
7 checks passed

pi0x pushed a commit to mixelburg/h3 that referenced this pull request Jul 2, 2026

fix(auth): reject Basic credentials with no colon separator (h3js#1393)

7ade5a0

coderabbitai Bot mentioned this pull request Jul 2, 2026

fix: set explicit content-type for Uint8Array responses #1386

Closed

coderabbitai Bot mentioned this pull request Jul 14, 2026

fix(auth): harden basic-auth realm handling and credential timing #1468

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: reject colonless Basic-auth credentials (RFC 7617 compliance)#1393

fix: reject colonless Basic-auth credentials (RFC 7617 compliance)#1393
pi0 merged 2 commits into
h3js:mainfrom
francisjohnjohnston-web:fix/basic-auth-no-colon-bypass

francisjohnjohnston-web commented May 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 24, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Poem

Uh oh!

pi0x left a comment

Uh oh!

pi0 left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

francisjohnjohnston-web commented May 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bug

Fix

Test

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented May 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Poem

Uh oh!

pi0x left a comment

Choose a reason for hiding this comment

Uh oh!

pi0 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

francisjohnjohnston-web commented May 24, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 24, 2026 •

edited

Loading