Skip to content

Commit aa470d2

Browse files
chrisbobbegnprice
authored andcommitted
api: Properly encode non-ASCII emails for HTTP auth headers
The base64.encode function requires all the code points in its input to be in the range U+0000..U+00FF. Effectively it requires that it can type-pun the string as a string of bytes, because the Base64 encoding itself is defined on sequences of bytes. But email addresses aren't restricted to that range, and haven't been for a long time. RFC 6532, "Internationalized Email Headers", dates to 2012. So some users have email addresses containing code points outside that range, and we should handle them so that those users are able to use the app. Here in the HTTP basic-auth header, one is generally supposed to do so (though the spec stops short of quite mandating this) by encoding the user-id and password -- which for Zulip means the user's email and API key -- in UTF-8, and then Base64-encoding those bytes. And indeed that's what the Zulip server expects. See discussion: https://chat.zulip.org/#narrow/stream/378-api-design/topic/Non-ASCII.20email.2Fapi_key.3F/near/1300660 So do that here. [greg: wrote new commit message]
1 parent 7874385 commit aa470d2

File tree

1 file changed

+2
-3
lines changed

1 file changed

+2
-3
lines changed

src/api/transport.js

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
/* @flow strict-local */
2-
import base64 from 'base-64';
3-
42
import type { Auth } from './transportTypes';
3+
import { base64Utf8Encode } from '../utils/encoding';
54

65
export const getAuthHeaders = (auth: Auth): {| Authorization?: string |} =>
76
// The `Object.freeze`` in the `:` case avoids a Flow issue:
87
// https://github.com/facebook/flow/issues/2386#issuecomment-695064325
98
auth.apiKey
10-
? { Authorization: `Basic ${base64.encode(`${auth.email}:${auth.apiKey}`)}` }
9+
? { Authorization: `Basic ${base64Utf8Encode(`${auth.email}:${auth.apiKey}`)}` }
1110
: Object.freeze({});

0 commit comments

Comments
 (0)