🧹 chore: Improve BasicAuth middleware RFC compliance (#3743)

Co-authored-by: RW <rene@gofiber.io>

Author: gaby

docs/middleware/basicauth.md

@@ -4,9 +4,9 @@ id: basicauth
 
 # BasicAuth
 
-Basic Authentication middleware for [Fiber](https://github.com/gofiber/fiber) that provides HTTP basic auth. It calls the next handler for valid credentials and returns [`401 Unauthorized`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401) or a custom response for missing or invalid credentials.
+Basic Authentication middleware for [Fiber](https://github.com/gofiber/fiber) that provides HTTP basic auth. It calls the next handler for valid credentials and returns [`401 Unauthorized`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401) for missing or invalid credentials, [`400 Bad Request`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/400) for malformed `Authorization` headers, or [`431 Request Header Fields Too Large`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/431) when the header exceeds size limits. Credentials may omit Base64 padding as permitted by RFC 7235's `token68` syntax.
 
-The default unauthorized response includes the header `WWW-Authenticate: Basic realm="Restricted", charset="UTF-8"`, sets `Cache-Control: no-store`, and adds a `Vary: Authorization` header.
+The default unauthorized response includes the header `WWW-Authenticate: Basic realm="Restricted", charset="UTF-8"`, sets `Cache-Control: no-store`, and adds a `Vary: Authorization` header. Only the `UTF-8` charset is supported; any other value will panic.
 
 ## Signatures
 
@@ -98,10 +98,11 @@ Users: map[string]string{
 | Next            | `func(fiber.Ctx) bool`     | Next defines a function to skip this middleware when it returns true.                                                                                                   | `nil`                 |
 | Users           | `map[string]string`         | Users maps usernames to **hashed** passwords (e.g. bcrypt, `{SHA256}`). | `map[string]string{}` |
 | Realm           | `string`                    | Realm is a string to define the realm attribute of BasicAuth. The realm identifies the system to authenticate against and can be used by clients to save credentials. | `"Restricted"`        |
-| Charset         | `string`                    | Charset sent in the `WWW-Authenticate` header, so clients know how credentials are encoded. | `"UTF-8"` |
+| Charset         | `string`                    | Charset sent in the `WWW-Authenticate` header. Only `"UTF-8"` is supported (case-insensitive). | `"UTF-8"` |
 | HeaderLimit     | `int`                       | Maximum allowed length of the `Authorization` header. Requests exceeding this limit are rejected. | `8192` |
 | Authorizer      | `func(string, string, fiber.Ctx) bool` | Authorizer defines a function to check the credentials. It will be called with a username, password, and the current context and is expected to return true or false to indicate approval.  | `nil`                 |
 | Unauthorized    | `fiber.Handler`             | Unauthorized defines the response body for unauthorized responses.                                                                                                    | `nil`                 |
+| BadRequest      | `fiber.Handler`             | BadRequest defines the response for malformed `Authorization` headers.                                                                                     | `nil`                 |
 
 ## Default Config
 
@@ -114,5 +115,6 @@ var ConfigDefault = Config{
     HeaderLimit:     8192,
     Authorizer:      nil,
     Unauthorized:    nil,
+    BadRequest:      nil,
 }
 ```

go.mod

@@ -26,6 +26,6 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	golang.org/x/net v0.44.0
 	golang.org/x/sys v0.36.0 // indirect
-	golang.org/x/text v0.29.0 // indirect
+	golang.org/x/text v0.29.0
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

middleware/basicauth/basicauth.go

@@ -2,10 +2,14 @@ package basicauth
 
 import (
 	"encoding/base64"
+	"errors"
 	"strings"
+	"unicode"
+	"unicode/utf8"
 
 	"github.com/gofiber/fiber/v3"
 	utils "github.com/gofiber/utils/v2"
+	"golang.org/x/text/unicode/norm"
 )
 
 // The contextKey type is unexported to prevent collisions with context keys defined in
@@ -24,6 +28,8 @@ func New(config Config) fiber.Handler {
 	// Set default config
 	cfg := configDefault(config)
 
+	var cerr base64.CorruptInputError
+
 	// Return new handler
 	return func(c fiber.Ctx) error {
 		// Don't execute middleware if Next returns true
@@ -32,20 +38,47 @@ func New(config Config) fiber.Handler {
 		}
 
 		// Get authorization header and ensure it matches the Basic scheme
-		auth := utils.Trim(c.Get(fiber.HeaderAuthorization), ' ')
-		if auth == "" || len(auth) > cfg.HeaderLimit {
+		rawAuth := c.Get(fiber.HeaderAuthorization)
+		if rawAuth == "" {
 			return cfg.Unauthorized(c)
 		}
-
-		parts := strings.Fields(auth)
-		if len(parts) != 2 || !utils.EqualFold(parts[0], basicScheme) {
+		if len(rawAuth) > cfg.HeaderLimit {
+			return c.SendStatus(fiber.StatusRequestHeaderFieldsTooLarge)
+		}
+		if containsInvalidHeaderChars(rawAuth) {
+			return cfg.BadRequest(c)
+		}
+		auth := strings.Trim(rawAuth, " \t")
+		if auth == "" {
 			return cfg.Unauthorized(c)
 		}
+		if len(auth) < len(basicScheme) || !utils.EqualFold(auth[:len(basicScheme)], basicScheme) {
+			return cfg.Unauthorized(c)
+		}
+		rest := auth[len(basicScheme):]
+		if len(rest) < 2 || rest[0] != ' ' || rest[1] == ' ' {
+			return cfg.BadRequest(c)
+		}
+		rest = rest[1:]
+		if strings.IndexFunc(rest, unicode.IsSpace) != -1 {
+			return cfg.BadRequest(c)
+		}
 
 		// Decode the header contents
-		raw, err := base64.StdEncoding.DecodeString(parts[1])
+		raw, err := base64.StdEncoding.DecodeString(rest)
 		if err != nil {
-			return cfg.Unauthorized(c)
+			if errors.As(err, &cerr) {
+				raw, err = base64.RawStdEncoding.DecodeString(rest)
+			}
+			if err != nil {
+				return cfg.BadRequest(c)
+			}
+		}
+		if !utf8.Valid(raw) {
+			return cfg.BadRequest(c)
+		}
+		if !norm.NFC.IsNormal(raw) {
+			raw = norm.NFC.Bytes(raw)
 		}
 
 		// Get the credentials
@@ -60,13 +93,17 @@ func New(config Config) fiber.Handler {
 		// which is "username:password".
 		index := strings.Index(creds, ":")
 		if index == -1 {
-			return cfg.Unauthorized(c)
+			return cfg.BadRequest(c)
 		}
 
 		// Get the username and password
 		username := creds[:index]
 		password := creds[index+1:]
 
+		if containsCTL(username) || containsCTL(password) {
+			return cfg.BadRequest(c)
+		}
+
 		if cfg.Authorizer(username, password, c) {
 			c.Locals(usernameKey, username)
 			return c.Next()
@@ -77,6 +114,16 @@ func New(config Config) fiber.Handler {
 	}
 }
 
+func containsCTL(s string) bool {
+	return strings.IndexFunc(s, unicode.IsControl) != -1
+}
+
+func containsInvalidHeaderChars(s string) bool {
+	return strings.IndexFunc(s, func(r rune) bool {
+		return (r < 0x20 && r != '\t') || r == 0x7F || r >= 0x80
+	}) != -1
+}
+
 // UsernameFromContext returns the username found in the context
 // returns an empty string if the username does not exist
 func UsernameFromContext(c fiber.Ctx) string {