?

Log in

No account? Create an account
Hmm, Opera doesn't seem to like doing HTTP auth with a password with… - 'Twas brillig, and the slithy toves did gyre and gimble in the wabe [entries|archive|friends|userinfo]
Thomas

[ website | Beware the Jabberwock... ]
[ deviantArt | the-boggyb ]
[ FanFiction | Torkell ]
[ Tumblr | torkellr ]

Links
[Random links| BBC news | Vulture Central | Slashdot | Dangerous Prototypes | LWN | Raspberry Pi]
[Fellow blogs| a Half Empty Glass | the Broken Cube | The Music Jungle | Please remove your feet | A letter from home]
[Other haunts| Un4seen Developments | Jazz 2 Online | EmuTalk.net | Feng's shui]

[Monday 1st January 2007 at 6:02 pm]
Thomas

boggyb
Hmm, Opera doesn't seem to like doing HTTP auth with a password with high ASCII (ÁÉÍÓÚ and friends). Curious. I thought HTTP was supposed to be 8-bit safe, and given that the password will be Base64 encoded anyway (if not hashed) they've got no excuse.

Edit: Well, either I'm mistyping the password or Firefox doesn't like them either (mistyped, Firefox works. Opera doesn't). How odd. Lemme check the RFC...

...yep, the username is defined as being 8-bit text excluding a ':' and the password is defined as any valid 8-bit text. The only characters not permitted are non-white-space control codes (0 .. 31). The spec even says to assume ISO-8859-1 for high ASCII.

Right, let's have a look with a packet sniffer...

...ah-hah! Opera transmits accented characters in some sort of multi-byte encoding (probably UTF-8), and there doesn't appear to be a setting to change this. Bad Opera.
Link | Previous Entry | Share | Next Entry[ 4 pennies | Penny for your thoughts? ]

Comments:
[User Picture]From: ralesk
Monday 1st January 2007 at 6:46 pm (UTC)
This is the popup window thingy that leads you to a 401 if you fail?
(Reply) (Thread)
[User Picture]From: boggyb
Monday 1st January 2007 at 8:12 pm (UTC)
Yep, that's the one. There's two ways of using it - horribly insecure, and slightly insecure - but it works well and is part of the HTTP spec, so pretty much everything supports it. I use it on my admin section as it doesn't need any server-side scripting to work.
(Reply) (Parent) (Thread)
[User Picture]From: ralesk
Monday 1st January 2007 at 8:36 pm (UTC)

Ahhh, hmm, can you set a charset=iso-8859-1 somehow in this?  I never used it, so I have no idea about how it works, what HTTP headers are in work here, etc.  Could be a way out though.

(Reply) (Parent) (Thread)
[User Picture]From: boggyb
Monday 1st January 2007 at 8:46 pm (UTC)
I don't think I can set one specifically for that header. I do know that I'm sending "Content-Type: text/html; charset=iso-8859-1", so Opera has no excuse. I'll have to raise it with the devs at some point.
(Reply) (Parent) (Thread)