Question

Rubyists,

something’s wrong with my HTTP AUTH params that are coming into my Rails 3 app. The password has some whitespace at the end. I was debugging my client app and it looks like it is sending it correctly.

I am doing this in my app:

params[:auth_username], params[:auth_password] = user_name_and_password(request)

Then I am sending this into Warden.

I would like to see the raw data to see if the whitespace is there. How to do that?

Edit: I have debugged the wire between httpd and thin process and I am pretty sure the data are coming correctly. It must be something wrong in my Rails 3.0.10. I was able to decode the base64 string that is coming in the headers and it did not contain any whitespace.

This really looks like BASE64 decoder issue. Maybe a padding problem. My string is:

Qmxvb21iZXJnOnRjbG1lU1JT

which decodes to

Bloomberg:tclmeSRS

correctly using non-Ruby base64 decoders. Even in Ruby:

>> Base64.decode64 "Qmxvb21iZXJnOnRjbG1lU1JT"
=> "Bloomberg:tclmeSRS"

I don’t get it. Searching for a bugreport in Rails or something like that.

Edit: So it turns out our Apache httpd proxy adds something to the header:

Authorization: Basic Qmxvb21iZXJnOnRjbG1lU1JT, Basic

This leads to the incorrect characters at the end of the password, because:

>> Base64.decode64('Basic Qmxvb21iZXJnOnRjbG1lU1JT, Basic'.split(' ', 2).last || '')
=> "Bloomberg:tclmeSRS\005\253\""

The question is now – is this correct? Is it a bug in httpd or rails?

Answer 1

Rails user_name_and_password method makes a call to decode_credentials that performs the following, then splits using “:” :

::Base64.decode64(request.authorization.split(' ', 2).last || '')

Applied to your data :

::Base64.decode64("Qmxvb21iZXJnOnRjbG1lU1JT".split(' ', 2).last || '').split(/:/, 2)
=> ["Bloomberg", "tclmeSRS"]

Everything seems to be ok, the problem sits elsewhere IMO. To dump the authorization data from your controller :

render :text => "Authorization: #{request.authorization}"