You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
api: Properly encode non-ASCII emails for HTTP auth headers
The base64.encode function requires all the code points in its input
to be in the range U+0000..U+00FF. Effectively it requires that it
can type-pun the string as a string of bytes, because the Base64
encoding itself is defined on sequences of bytes.
But email addresses aren't restricted to that range, and haven't
been for a long time. RFC 6532, "Internationalized Email Headers",
dates to 2012. So some users have email addresses containing
code points outside that range, and we should handle them so that
those users are able to use the app.
Here in the HTTP basic-auth header, one is generally supposed to do
so (though the spec stops short of quite mandating this) by encoding
the user-id and password -- which for Zulip means the user's email
and API key -- in UTF-8, and then Base64-encoding those bytes.
And indeed that's what the Zulip server expects. See discussion:
https://chat.zulip.org/#narrow/stream/378-api-design/topic/Non-ASCII.20email.2Fapi_key.3F/near/1300660
So do that here.
[greg: wrote new commit message]
0 commit comments