[arquillian-issues] [JBoss JIRA] (ARQ-630) The default charset is used to encode the HTTP BASIC AUTH credentials string into a sequence of bytes. ISO-8859-1 should be used for Tomcat
The default charset is used to encode the HTTP BASIC AUTH credentials string into a
sequence of bytes. ISO-8859-1 should be used for Tomcat
-------------------------------------------------------------------------------------------------------------------------------------------
Key: ARQ-630
URL: https://issues.jboss.org/browse/ARQ-630
Project: Arquillian
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Tomcat Containers
Reporter: Vineet Reynolds
Assignee: Vineet Reynolds
Tomcat decodes the Authorization HTTP header containing the HTTP BASIC authentication
credentials, using the ISO-8859-1 charset. On the contrary, Arquillian uses
{{Charset.defaultCharset}} to encode the supplied credentials, before Base64 encoding the
resulting byte array. This can result in a 401 error, when accessing the manager
application on Tomcat; the failure will occur when the credentials contain characters that
are encoded differently in ISO-8859-1 and the default charset of the environment. For
example, if the default charset is UTF-8, then credentials containing _ö_ will not be
accepted by Tomcat as _ö_ is encoded as 0xC3 0xB6 in UTF-8 and 0xF6 in ISO-8859-1.
The suggested fix is to use ISO-8859-1 in
{{CommonTomcatManager.constructHttpBasicAuthHeader()}} as listed:
{code:java}
// Set up an authorization header with our credentials
String credentials = configuration.getUser() + ":" +
configuration.getPass();
return "Basic "
+ new
String(Base64.encodeBase64(credentials.getBytes(Charset.forName("ISO-8859-1"))),
Charset.defaultCharset());
{code}
instead of the existing
{code:java}
// Set up an authorization header with our credentials
String credentials = configuration.getUser() + ":" +
configuration.getPass();
return "Basic "
+ new
String(Base64.encodeBase64(credentials.getBytes(Charset.defaultCharset())),
Charset.defaultCharset());
{code}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira