From 47a5c35560a96fe8c5b17526f672ae8b0fc0efb8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Ant=C3=B4nio=20Duarte?=
 <joao.antonioduarte@hotmail.com>
Date: Tue, 13 Aug 2019 11:50:56 -0300
Subject: [PATCH] Basic Authorization Header Decoding Improvements

---
 sources/MVCFramework.Middleware.JWT.pas | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/sources/MVCFramework.Middleware.JWT.pas b/sources/MVCFramework.Middleware.JWT.pas
index 21ae48c4..be032e26 100644
--- a/sources/MVCFramework.Middleware.JWT.pas
+++ b/sources/MVCFramework.Middleware.JWT.pas
@@ -269,7 +269,7 @@ procedure TMVCJWTAuthenticationMiddleware.OnBeforeRouting(AContext: TWebContext;
 var
   LUsername: string;
   LPassword: string;
-  LBasicAuthEncoded: string;
+  LBasicAuthHeader: string;
   LBasicAuthParts: TArray<string>;
   LRolesList: TList<string>;
   LSessionData: TSessionData;
@@ -280,8 +280,8 @@ var
 begin
   if SameText(AContext.Request.PathInfo, FLoginURLSegment) then
   begin
-    LBasicAuthEncoded := AContext.Request.Headers[FAuthorizationHeaderName];
-    if LBasicAuthEncoded.IsEmpty then
+    LBasicAuthHeader := AContext.Request.Headers[FAuthorizationHeaderName];
+    if LBasicAuthHeader.IsEmpty then
     begin
       LUsername := TNetEncoding.URL.Decode(AContext.Request.Headers[FUserNameHeaderName]);
       LPassword := TNetEncoding.URL.Decode(AContext.Request.Headers[FPasswordHeaderName]);
@@ -290,13 +290,13 @@ begin
     end
     else
     begin
-      if not LBasicAuthEncoded.StartsWith('basic', True) then
+      if not LBasicAuthHeader.StartsWith('basic', True) then
         raise EMVCJWTException.Create(HTTP_STATUS.Unauthorized, 'Invalid authorization type');
 
-      LBasicAuthEncoded := LBasicAuthEncoded.Replace('basic ', '', [rfIgnoreCase]);
-      LBasicAuthParts := TBase64Encoding.Base64.Decode(LBasicAuthEncoded).Split([':']);
+      LBasicAuthHeader := LBasicAuthHeader.Remove(0, 'basic'.Length).Trim;
+      LBasicAuthParts := TBase64Encoding.Base64.Decode(LBasicAuthHeader).Split([':']);
 
-      if Length(LBasicAuthParts) < 2 then
+      if Length(LBasicAuthParts) <> 2 then
         raise EMVCJWTException.Create(HTTP_STATUS.Unauthorized, 'Invalid authorization type');
 
       LUserName := LBasicAuthParts[0];