kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Merge pull request #14212 from tylerhunt/fix-token-regex

Browse source 
Handle tab in token authentication header.
This commit is contained in:
Sean Griffin 2015-12-15 10:59:54 -07:00
commit 1ad94e760d
2 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
actionpack/lib/action_controller/metal/http_authentication.rb
View file

@ -397,7 +397,7 @@ module ActionController
# RewriteRule ^(.*)$ dispatch.fcgi [E=X-HTTP_AUTHORIZATION:%{HTTP:Authorization},QSA,L]
module Token
TOKEN_KEY = 'token='
TOKEN_REGEX = /^(Token|Bearer) /
TOKEN_REGEX = /^(Token|Bearer)\s+/
AUTHN_PAIR_DELIMITERS = /(?:,|;|\t+)/
extend self

8
actionpack/test/controller/http_token_authentication_test.rb
View file

@ -94,6 +94,14 @@ class HttpTokenAuthenticationTest < ActionController::TestCase
assert_response :success
end
test "authentication request with tab in header" do
@request.env['HTTP_AUTHORIZATION'] = "Token\ttoken=\"lifo\""
get :index
assert_response :success
assert_equal 'Hello Secret', @response.body
end
test "authentication request without credential" do
get :display