Skip to content

fix(auth): decode Basic-auth credentials as UTF-8#1463

Merged
pi0 merged 2 commits into
mainfrom
fix/basic-auth-utf8
Jul 14, 2026
Merged

fix(auth): decode Basic-auth credentials as UTF-8#1463
pi0 merged 2 commits into
mainfrom
fix/basic-auth-utf8

Conversation

@pi0x

@pi0x pi0x commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Bug

requireBasicAuth decoded the base64 Authorization header with atob(), which returns a Latin-1 string. UTF-8 credential bytes were therefore never decoded, so a user with a non-ASCII password (RFC 7617 charset="UTF-8") could never authenticate — the server compares against TextEncoder/UTF-8 values, guaranteeing a mismatch.

Fix

Decode the base64 payload through TextDecoder("utf-8") so multi-byte credentials round-trip correctly, and advertise charset="UTF-8" in the WWW-Authenticate challenge per RFC 7617. Added regression tests covering a non-ASCII password and the challenge header.

🤖 Generated with Claude Code

@pi0 @claude
fix(auth): decode Basic-auth credentials as UTF-8
08743b2 
atob() returns Latin-1, so UTF-8 credential bytes were never decoded and
users with non-ASCII passwords (RFC 7617 charset="UTF-8") could never
authenticate. Decode the base64 payload through TextDecoder("utf-8") and
advertise charset="UTF-8" in the WWW-Authenticate challenge.

Co-Authored-By: Claude Fable 5 <[email protected]>
@pi0x
pi0x requested a review from pi0 as a code owner July 14, 2026 12:34
pi0x
pi0x commented Jul 14, 2026
View reviewed changes

@pi0x pi0x left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review: Approve (posted as comment — GitHub blocks self-approval on this account)

Clean, correctly-scoped fix. Verified locally on the branch: pnpm vitest run test/auth.test.ts → 36/36 pass, pnpm lint (oxlint + oxfmt) clean.

Correctness

  • The decode idiom new TextDecoder("utf-8", { fatal: false }).decode(Uint8Array.from(atob(b64auth), c => c.charCodeAt(0))) is the standard, correct way to round-trip UTF-8 credential bytes that atob() would otherwise leave as Latin-1.
  • fatal: false is the right call: invalid UTF-8 produces U+FFFD replacements → auth mismatch → 401, never an unhandled 500. Invalid base64 still throws from atob() and is caught → 401 (covered by the existing "responds 401 for invalid base64" test).
  • Colon-split via indexOf(":")/slice still keeps : characters in passwords (existing multi-colon tests pass).
  • Challenge Basic realm="...", charset="UTF-8" matches the RFC 7617 §2.1 example verbatim and is valid per RFC 7235 auth-param grammar.

Tests

  • The UTF-8 regression test exercises a genuine multi-byte password (pä$$wörd🔒, including a 4-byte emoji) end-to-end and asserts a 200. The challenge test asserts charset="UTF-8" on the 401. Buffer usage is consistent with the rest of the file.

Scope / style

  • Change is limited to the auth decode, the challenge header, and tests — no scope creep. Style, formatting, and comments follow AGENTS.md conventions.

🤖 Generated with Claude Code

@codecov

codecov Bot commented Jul 14, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@coderabbitai

coderabbitai Bot commented Jul 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review limit reached

@pi0x, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 49 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2fd50b9a-cad9-456d-b3ff-f3f2993c2257

📥 Commits

Reviewing files that changed from the base of the PR and between 8ed97e4 and 8face06.

📒 Files selected for processing (2)
  • src/utils/auth.ts
  • test/auth.test.ts
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/basic-auth-utf8

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@pi0x pi0x mentioned this pull request Jul 14, 2026
Merged
@pi0 @claude
fix(auth): fall back to Latin-1 for non-UTF-8 Basic-auth credentials
8face06 
Try strict UTF-8 decoding first and keep the raw atob() Latin-1
interpretation when the bytes are not valid UTF-8, so legacy
(pre-RFC 7617) clients sending Latin-1 credentials can still
authenticate. This also avoids collapsing distinct invalid byte
sequences into U+FFFD replacement characters.

Co-Authored-By: Claude Fable 5 <[email protected]>
@pi0x

pi0x commented Jul 14, 2026

Copy link
Copy Markdown
Contributor Author

Good idea — implemented in 8face06. The decode is now: strict UTF-8 first (TextDecoder("utf-8", { fatal: true })), and on failure keep the raw atob() Latin-1 string, so legacy (pre-RFC 7617) clients sending Latin-1 credentials still authenticate.

Notes from evaluating it:

  • Correctness: ASCII is identical in both encodings, so ambiguity only exists when a Latin-1 client sends bytes that happen to form valid UTF-8 (e.g. Latin-1 "é" = C3 A9 = UTF-8 "é"). That's the inherent cost of any charset sniff, is vanishingly rare for real passwords, and fails closed (401), never open.
  • Security: No credential-equivalence risk — strict UTF-8 decoding and Latin-1 are each injective, so the only cross-path overlap is that the UTF-8 and Latin-1 encodings of the same password both authenticate, which is the point. It's actually safer than the previous fatal: false decode, where distinct invalid byte sequences collapsed into U+FFFD replacement characters.
  • The challenge still advertises charset="UTF-8" (RFC 7617); the fallback is receive-side leniency only.

Added a regression test for a genuinely Latin-1-encoded credential (0xE4, invalid as UTF-8) and confirmed it failed before the change.

@pi0
pi0 merged commit eb4ce98 into main Jul 14, 2026
8 of 9 checks passed
@pi0
pi0 deleted the fix/basic-auth-utf8 branch July 14, 2026 12:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pi0 pi0 pi0 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@pi0x @pi0