Merge pull request #5 from checkr/zz/fix-empty-password

Fix empty password
checkr · Apr 20, 2018 · 54ba707 · 54ba707
2 parents 7a8b7a8 + 0d1e37c
commit 54ba707
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/kong/plugins/basicauth2keyauth/handler.lua b/kong/plugins/basicauth2keyauth/handler.lua
@@ -28,7 +28,7 @@ local function retrieve_credentials(request, header_name, conf)
     if m and m[1] then
       local decoded_basic = ngx.decode_base64(m[1])
       if decoded_basic then
-        local basic_parts, err = ngx.re.match(decoded_basic, "([^:]+):?(.*)", "oj")
+        local basic_parts, err = ngx.re.match(decoded_basic, "([^:\\s]+):?([^\\s]*)", "oj")
         if err then
           ngx.log(ngx.ERR, err)
           return

diff --git a/spec/basicauth2keyauth/01-access_spec.lua b/spec/basicauth2keyauth/01-access_spec.lua
@@ -113,5 +113,18 @@ describe("Plugin: key-auth (access)", function()
       local header_value = assert.request(res).has.header("apikey_from_basicauth")
       assert.equal("632d187cde1f395f3fb17e9783748d101b70174988a8e148bc7bc20f63453ea5", header_value)
     end)
+    it("generates new api_key header with sha256 value if password is just empty", function()
+      local res = assert(client:send {
+        method = "GET",
+        path = "/request",
+        headers = {
+          ["Host"] = "host2.com",
+          ["Authorization"] = "BASIC YXBpMTIzNDog" -- "api1234: "
+        }
+      })
+      assert.res_status(200, res)
+      local header_value = assert.request(res).has.header("apikey_from_basicauth")
+      assert.equal("632d187cde1f395f3fb17e9783748d101b70174988a8e148bc7bc20f63453ea5", header_value)
+    end)
   end)
 end)