Merge pull request #4375 from evolvedbinary/hotfix/http-bearer-auth

Do not override Bearer Authentication with Basic Authentication

Author: dizzzz

exist-core/src/main/java/org/exist/http/servlets/AbstractExistHttpServlet.java

@@ -246,9 +246,9 @@ protected Subject authenticate(HttpServletRequest request, HttpServletResponse r
 	        }
         }
 
-        // Secondly try basic authentication
+        // Secondly try basic authentication if there is no Authorization header or the Authorization header does not indicate Basic auth
         final String auth = request.getHeader("Authorization");
-        if (auth == null && getDefaultUser() != null) {
+        if ((auth == null || !auth.toLowerCase().startsWith("basic ")) && getDefaultUser() != null) {
             return getDefaultUser();
         }
         return getAuthenticator().authenticate(request, response, true);

exist-core/src/main/java/org/exist/http/servlets/BasicAuthenticator.java

@@ -61,16 +61,16 @@ public Subject authenticate(
 		String password = null;
 
 		try {
-			if (credentials != null && credentials.startsWith("Basic")) {
-				final byte[] c = Base64.decodeBase64(credentials.substring("Basic ".length()));
+			if (credentials != null && credentials.toLowerCase().startsWith("basic ")) {
+				final byte[] c = Base64.decodeBase64(credentials.substring("basic ".length()));
 				final String s = new String(c, UTF_8);
 				// LOG.debug("BASIC auth credentials: "+s);
 				final int p = s.indexOf(':');
 				username = p < 0 ? s : s.substring(0, p);
 				password = p < 0 ? null : s.substring(p + 1);
 			}
 		} catch(final IllegalArgumentException iae) {
-			LOG.warn("Invalid BASIC authentication header received: {}", iae.getMessage(), iae);
+			LOG.warn("Invalid Basic Authentication header received: {}", iae.getMessage(), iae);
 			credentials = null;
 		}
 

exist-core/src/main/java/org/exist/http/urlrewrite/XQueryURLRewrite.java

@@ -179,7 +179,7 @@ protected void service(final HttpServletRequest request, final HttpServletRespon
         } else {
             // Secondly try basic authentication
             final String auth = request.getHeader("Authorization");
-            if (auth != null) {
+            if (auth != null && auth.toLowerCase().startsWith("basic ")) {
                 requestUser = authenticator.authenticate(request, response, sendChallenge);
                 if (requestUser != null) {
                     user = requestUser;