Ruby on Rails | Screencasts | Download | Documentation | Weblog | Community | Source

Ticket #9747 (closed defect: untested)

Opened 9 months ago

Last modified 9 months ago

[PATCH] HTTP auth methods can't handle Latin-1 in headers

Reported by: boof Assigned to: core
Priority: normal Milestone: 2.x
Component: ActionPack Version: edge
Severity: normal Keywords: http auth basic unicode multibytebugs verified
Cc:

Description

Having a username or password with umlauts does not work. Doesn't try to iconv it. Don't see a way to change the charset within rails. Since Rails goes UTF-8 everywhere it should here, too.

Attachments

assume_authentication_headers_are_latin1_when_not_utf8.diff (1.8 kB) - added by manfred on 10/01/07 17:00:21.
force_browser_to_send_http_auth_in_utf-8_patch.diff (0.7 kB) - added by boof on 10/03/07 09:09:24.
sends accept-charset header before auth request is send
send_accept_charset_header_with_basic_auth.diff (1.2 kB) - added by norbert on 10/03/07 11:13:38.
send_accept_charset_header_with_basic_auth.2.diff (1.7 kB) - added by norbert on 10/03/07 14:04:02.
How about this?

Change History

10/01/07 16:59:49 changed by manfred

  • keywords changed from http auth basic unicode utf-8 to http auth basic unicode utf-8 multibytebugs.

You're right, it looks like at least Camino (Mozilla) sends the authorization header as Latin-1 instead of UTF-8 even though the 401 clearly responds with a Content-Type of UTF-8.

I'm uploading a patch that allows both UTF-8 and ISO 8859-1 characters in the credentials, converting the ISO 8859-1 characters to UTF-8.

Can you check if the patch solves your problems?

10/01/07 17:00:21 changed by manfred

  • attachment assume_authentication_headers_are_latin1_when_not_utf8.diff added.

10/01/07 18:20:27 changed by manfred

  • component changed from ActiveRecord to ActionPack.
  • summary changed from http auth can't take umlauts (unicode trouble) to [PATCH] http authentication methods can't handle Latin-1 in headers.

10/02/07 15:42:57 changed by boof

I'll try this when I'm at home, thanks!

10/03/07 08:44:52 changed by boof

Works fine!

10/03/07 09:07:24 changed by boof

But what I meant was something like 

controller.headers["Accept-Charset"] = 'UTF-8'

right before 

controller.headers["WWW-Authenticate"] = ...

Patch attached...

10/03/07 09:09:24 changed by boof

  • attachment force_browser_to_send_http_auth_in_utf-8_patch.diff added.

sends accept-charset header before auth request is send

10/03/07 09:14:17 changed by manfred

Does that actually make all browsers behave?

10/03/07 09:52:52 changed by boof

These are the Browsers I could test:

  • Safari 3.0.3 - ok
  • Firefox 2.0.0.7 - ok
  • Internet Explorer 7.0.6000.16512 - ok
  • Opera 9.10.8679 - ok

10/03/07 09:54:13 changed by boof

Safari and FF on MOX Tiger IE and Opera on Win Vista

10/03/07 10:02:31 changed by boof

  • lynx 2.8.6rel.5_0 (macports) - ok

10/03/07 11:13:38 changed by norbert

  • attachment send_accept_charset_header_with_basic_auth.diff added.

10/03/07 11:16:36 changed by norbert

  • keywords changed from http auth basic unicode utf-8 multibytebugs to http auth basic unicode multibytebugs.
  • summary changed from [PATCH] http authentication methods can't handle Latin-1 in headers to [PATCH] HTTP auth methods can't handle Latin-1 in headers.

Here's an updated version of boof's patch that has a simple test, and it was generated with the right path.

10/03/07 11:37:13 changed by manfred

Right, very nice. +1 for inclusion of Norbert's patch.

10/03/07 13:30:02 changed by lifofifo

Shouldn't it use ActionController::Base.default_charset ?

10/03/07 14:00:17 changed by norbert

Indeed, new patch is in the works.

10/03/07 14:04:02 changed by norbert

  • attachment send_accept_charset_header_with_basic_auth.2.diff added.

How about this?

10/03/07 14:15:00 changed by lifofifo

Looks good. +1

10/03/07 15:12:45 changed by boof

Sorry for the inconvience, but can anybody test this again. I can't reproduce success when sending the accept-charset header before this. :(

10/03/07 15:46:36 changed by boof

Opera still does, but IE, Safari and FF don't want to. I think I tried everything.

I tried Content-Type and Charset in headers and even send a complete html in the response body with given charset = UTF-8. Opera uses Latin-1 per default, too. Lynx uses my bash default charset I think.

I can't figure out how FF, IE and Safari guess the charset on 401/WWW-Authentication. Does anybody know?

10/03/07 16:14:35 changed by norbert

boof, your last message is a bit confusing. Does the latest patch solve your problem?

10/04/07 06:10:49 changed by boof

After an svn update I didn't have any success with the solution B (send Accept-Charset before WWW-Authentication).

I guess that the first time I changed http_authentication.rb with solution A (convert String afterwards) I restarted the server by behaviour but the time I tried solution B I just didn't.

The only browser I still get to work with solution B is Opera. FF, IE and Safari just use their default Charset, imho...

10/08/07 18:47:42 changed by boof

  • status changed from new to closed.
  • resolution set to fixed.

assume_authentication_headers_are_latin1_when_not_utf8.diff works!

10/08/07 18:59:01 changed by manfred

  • status changed from closed to reopened.
  • resolution deleted.

I'm sorry, but that's not how we use trac (: The ticket only gets closed as fixed when the patch is applied.

10/09/07 03:54:16 changed by boof

Ahh, sorry, my mistake!

10/15/07 04:09:23 changed by bitsweat

  • status changed from reopened to closed.
  • resolution set to incomplete.

I applied the patch to trunk but got a test failure: 

  1) Failure:
test_authorization_with_non_ascii_characters(HttpBasicAuthenticationTest)
    [./test/controller/http_authentication_test.rb:45:in `test_authorization_with_non_ascii_characters'
     /usr/local/lib/ruby/gems/1.8/gems/mocha-0.5.5/lib/mocha/test_case_adapter.rb:19:in `__send__'
     /usr/local/lib/ruby/gems/1.8/gems/mocha-0.5.5/lib/mocha/test_case_adapter.rb:19:in `run']:
<false> is not true.

10/18/07 17:49:50 changed by mikong

  • keywords changed from http auth basic unicode multibytebugs to http auth basic unicode multibytebugs verified.
  • status changed from closed to reopened.
  • resolution deleted.

I can't seem to find the test_authorization_with_non_ascii_characters method in http_authentication_test.rb. I applied the patch locally, ran the tests and didn't get a test failure. Am I missing something here?

+1

10/18/07 17:54:12 changed by mikong

It looks like the test I was looking for was in the first patch submitted. But the patch we're looking at is the most recent one by norbert right?

10/18/07 18:41:30 changed by bitsweat

  • status changed from reopened to closed.
  • resolution set to untested.

mikong, see boof's comments.

Please reopen when there is a verified patch with unit tests. The 'incomplete' and 'untested' resolutions are used to indicate the ticket's progress along this path.

10/19/07 15:03:40 changed by mikong

Oops, I'm very sorry about that.