BasicAuthenticationFilter case insenstive

Fixes: gh-5586
spring-projects · Jul 31, 2018 · e3d4d66 · e3d4d66
1 parent 2cd2bab
commit e3d4d66
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 1 deletion.
diff --git a/...n/java/org/springframework/security/web/authentication/www/BasicAuthenticationFilter.java b/...n/java/org/springframework/security/web/authentication/www/BasicAuthenticationFilter.java
@@ -154,7 +154,7 @@ protected void doFilterInternal(HttpServletRequest request,
 
 		String header = request.getHeader("Authorization");
 
-		if (header == null || !header.startsWith("Basic ")) {
+		if (header == null || !header.toLowerCase().startsWith("basic ")) {
 			chain.doFilter(request, response);
 			return;
 		}

diff --git a/...a/org/springframework/security/web/authentication/www/BasicAuthenticationFilterTests.java b/...a/org/springframework/security/web/authentication/www/BasicAuthenticationFilterTests.java
@@ -156,6 +156,26 @@ public void testNormalOperation() throws Exception {
 				.isEqualTo("rod");
 	}
 
+	// gh-5586
+	@Test
+	public void doFilterWhenSchemeLowercaseThenCaseInsensitveMatchWorks() throws Exception {
+		String token = "rod:koala";
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		request.addHeader("Authorization",
+				"basic " + new String(Base64.encodeBase64(token.getBytes())));
+		request.setServletPath("/some_file.html");
+
+		// Test
+		assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
+		FilterChain chain = mock(FilterChain.class);
+		filter.doFilter(request, new MockHttpServletResponse(), chain);
+
+		verify(chain).doFilter(any(ServletRequest.class), any(ServletResponse.class));
+		assertThat(SecurityContextHolder.getContext().getAuthentication()).isNotNull();
+		assertThat(SecurityContextHolder.getContext().getAuthentication().getName())
+				.isEqualTo("rod");
+	}
+
 	@Test
 	public void testOtherAuthorizationSchemeIsIgnored() throws Exception {