summaryrefslogtreecommitdiff
path: root/module/web
diff options
context:
space:
mode:
authorAleix Conchillo Flaqué <aconchillo@gmail.com>2022-06-24 09:34:53 -0700
committerLudovic Courtès <ludo@gnu.org>2022-07-04 11:16:36 +0200
commita84d8f6473979e5967e7eafa0a46ab74e12cc036 (patch)
tree59bd544a9acb7d39c0244be2cbbcb1161855e3bd /module/web
parent7e048c6c516fa477366c6b4b09914dcff44b2f5e (diff)
downloadguile-a84d8f6473979e5967e7eafa0a46ab74e12cc036.tar.gz
web: send capitalized authorization header scheme
* module/web/http.scm (write-credentials): capitalize authorization header scheme. The standard allows the scheme to be case-insensitive, however most libraries out there expect the scheme to be capitalized, which is what it is actually used in RFC docs (e.g. https://datatracker.ietf.org/doc/html/rfc7617#section-2). Some libraries even reject lowercase scheme making Guile incompatible. Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Diffstat (limited to 'module/web')
-rw-r--r--module/web/http.scm14
1 files changed, 12 insertions, 2 deletions
diff --git a/module/web/http.scm b/module/web/http.scm
index 4276e1744..6af790384 100644
--- a/module/web/http.scm
+++ b/module/web/http.scm
@@ -962,13 +962,23 @@ as an ordered alist."
(((? symbol?) . (? key-value-list?)) #t)
(_ #f)))
+;; While according to RFC 7617 Schemes are case-insensitive:
+;;
+;; 'Note that both scheme and parameter names are matched
+;; case-insensitive'
+;;
+;; some software (*) incorrectly assumes title case for scheme
+;; names, so use the more titlecase.
+;;
+;; (*): See, e.g.,
+;; https://community.spotify.com/t5/Spotify-for-Developers/API-Authorization-header-doesn-t-follow-HTTP-spec/m-p/5397381#M4917
(define (write-credentials val port)
(match val
(('basic . cred)
- (put-string port "basic ")
+ (put-string port "Basic ")
(put-string port cred))
((scheme . params)
- (put-symbol port scheme)
+ (put-string port (string-titlecase (symbol->string scheme)))
(put-char port #\space)
(write-key-value-list params port))))