Delphi/delphimvcframework
1
0
Fork 0
mirror of https://github.com/danieleteti/delphimvcframework.git synced 2024-11-15 07:45:54 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Basic Authorization Header Decoding Improvements

Browse Source
This commit is contained in:
João Antônio Duarte 2019-08-13 11:50:56 -03:00
parent ec2ce12089
commit 47a5c35560
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sources/MVCFramework.Middleware.JWT.pas
View File

@ -269,7 +269,7 @@ procedure TMVCJWTAuthenticationMiddleware.OnBeforeRouting(AContext: TWebContext;
var
LUsername: string;
LPassword: string;
LBasicAuthEncoded: string;
LBasicAuthHeader: string;
LBasicAuthParts: TArray<string>;
LRolesList: TList<string>;
LSessionData: TSessionData;
@ -280,8 +280,8 @@ var
begin
if SameText(AContext.Request.PathInfo, FLoginURLSegment) then
begin
LBasicAuthEncoded := AContext.Request.Headers[FAuthorizationHeaderName];
if LBasicAuthEncoded.IsEmpty then
LBasicAuthHeader := AContext.Request.Headers[FAuthorizationHeaderName];
if LBasicAuthHeader.IsEmpty then
begin
LUsername := TNetEncoding.URL.Decode(AContext.Request.Headers[FUserNameHeaderName]);
LPassword := TNetEncoding.URL.Decode(AContext.Request.Headers[FPasswordHeaderName]);
@ -290,13 +290,13 @@ begin
end
else
begin
if not LBasicAuthEncoded.StartsWith('basic', True) then
if not LBasicAuthHeader.StartsWith('basic', True) then
raise EMVCJWTException.Create(HTTP_STATUS.Unauthorized, 'Invalid authorization type');
LBasicAuthEncoded := LBasicAuthEncoded.Replace('basic ', '', [rfIgnoreCase]);
LBasicAuthParts := TBase64Encoding.Base64.Decode(LBasicAuthEncoded).Split([':']);
LBasicAuthHeader := LBasicAuthHeader.Remove(0, 'basic'.Length).Trim;
LBasicAuthParts := TBase64Encoding.Base64.Decode(LBasicAuthHeader).Split([':']);
if Length(LBasicAuthParts) < 2 then
if Length(LBasicAuthParts) <> 2 then
raise EMVCJWTException.Create(HTTP_STATUS.Unauthorized, 'Invalid authorization type');
LUserName := LBasicAuthParts[0];