88432 - Authorization header is invalid while using Basic authentication, for chinese characters.

Status: VERIFIED DUPLICATE of bug 41489

(Core :: Internationalization, defect, P2)

Description

[hyvu]

The authorization header(HTTP header) is invalid while using Basic 
authentication. This happens when we enter chinese characters on a Windows 2000 
machine.

This problem happens on Netscape browser 6.1 version.
This problem does not happen on Netscape 4.75 version.

Step to reproduce:
- Set up Windows 2000 machine to allow entering chinese characters.
- Now if we set out application to use Basic Authentication.
- When the basic authentication dialog prompts for the user name and password
- Enter the chinese characters.
- The browser will set the Authorization HTTP header.  
- At the server end when we try to retrieve the user name from the 
authorization header, we receive some garbage data.

Comment 1

[Mitchell Stoltz (not reading bugmail)]

I'm guessing this is a localization problem. Should it go to L10n or Networking?

Comment 2

[Andreas Becker]

Re-assigning to internationalization and switching qa contact to ylong.

Comment 3

[nhottanscp]

Reporter, could you put a test case (URL)?

Comment 4

[Frank Tang]

Can you put down the text you type  in GB/BIG5 code point and the bytes you 
received at the server ?

Here is some background infor I digged:
HTTP 1.1 Authorization is described under 
http://www.cis.ohio-state.edu/cgi-bin/rfc/rfc2068.html#sec-14.8
...
 Authorization  = "Authorization" ":" credentials
....

also "credentials" is defined as 
http://www.cis.ohio-state.edu/cgi-bin/rfc/rfc2068.html#sec-11
....
          credentials    = basic-credentials
                              | auth-scheme #auth-param
....
and
basic-credentials is defined as 
http://www.cis.ohio-state.edu/cgi-bin/rfc/rfc2068.html#sec-11.1
....
basic-credentials = "Basic" SP basic-cookie
basic-cookie   = <base64 [7] encoding of user-pass,
              except not limited to 76 char/line>
user-pass   = userid ":" password
userid      = *<TEXT excluding ":">
password    = *TEXT
....
and also from http://www.cis.ohio-state.edu/cgi-bin/rfc/rfc2068.html#sec-2.2

The TEXT rule is only used for descriptive field contents and values that are 
not intended to be interpreted by the message parser. Words of *TEXT may contain 
characters from character sets other than ISO8859-1 [22] only when encoded 
according to the rules of RFC 1522 [14]. 

....
TEXT           = <any OCTET except CTLs,
                  but including LWS>
....


In the http://www.cis.ohio-state.edu/cgi-bin/rfc/rfc2068.html#sec-11.1, it give 
an example of ascii user name and password field:

If the user agent wishes to send the userid "Aladdin" and password "open 
sesame", it would use the following header field: 

Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

Here is my question:
1. does client side RFC1522 encode those characters, if we do, what charset we 
used ?
2. does sever side code know how to decode RFC1522 header?

Comment 5

[Frank Tang]

Find the problem code, under
http://lxr.mozilla.org/seamonkey/source/netwerk/protocol/http/src/nsHttpBasicAut
h.cpp#55
 58 nsresult
 59 nsHttpBasicAuth::GenerateCredentials(nsIHttpChannel *httpChannel,
 60                                      const char *challenge,
 61                                      const PRUnichar *username,
 62                                      const PRUnichar *password,
 63                                      char **creds)
 64 
....
 74     // we work with ASCII around here
 75     nsCAutoString userpass;
 76     userpass.AssignWithConversion(username);
 77     if (password) {
 78         userpass.Append(':');
 79         userpass.AppendWithConversion(password);
 80     }

Line 76,79 cause the problem. we cast down PRUnichar to char . 
What we need to change line 76 to
if(username.IsASCII())
{ 
   // ASCII only
   userpass.AssignWithConversion(username);
} else {
   // Convert Unicode to RFC1522 encoded word
   // we need to RFC1522 encode username before assign to userpass, but
   // what charset should we encode to ?
}
and line 79 to
if(username.IsASCII())
{
   // ASCII only
   userpass.AppendWithConversion(password);
} else {
   // Convert Unicode to RFC1522 encoded word
   // we need to RFC1522 encode username before assign to userpass, but
   // what charset should we encode to ?
}

nhotta, can you work with darin about this ?

Comment 6

[Frank Tang]

reassign to darin
darin, please work with nhotta. Nhotta know where is the code which you can use 
to do RFC1522 encode

Comment 7

[Gagan]

Frank: this is marked as a blocker. Do you think it's critical we fix this for
nsBranch? If so please nominate and assign to me. 

Comment 8

[Darin Fisher]

stepping down from blocker status, moving to moz 0.9.4

Comment 9

[Darin Fisher]

*** This bug has been marked as a duplicate of 41489 ***

Comment 10

[Yuying Long]

Marking it as verified.