fix: enforce RFC 7617 colon-free username across all Basic Auth paths

- Skip supervision WebSocket auth with warning when supervisionUser
  contains ':' (convergence point for templates and all API paths)
- Reject ':' in authentication.username via Zod regex in UI config
  schema (covers ui/web and ui/cli config files)

diff --git a/src/charging-station/ChargingStation.ts b/src/charging-station/ChargingStation.ts
index 2cb492c3cab3f47bea9cc6a21f703340113a46cc..a17df487e3cce4abf7e5c6362357420bedc4e983 100644 (file)
--- a/src/charging-station/ChargingStation.ts
+++ b/src/charging-station/ChargingStation.ts
@@ -863,7 +863,13 @@ export class ChargingStation extends EventEmitter {
       return
     }
     if (this.stationInfo?.supervisionUser != null && this.stationInfo.supervisionPassword != null) {
-      options.auth = `${this.stationInfo.supervisionUser}:${this.stationInfo.supervisionPassword}`
+      if (this.stationInfo.supervisionUser.includes(':')) {
+        logger.warn(
+          `${this.logPrefix()} Supervision user contains ':' which is invalid in HTTP Basic Auth (RFC 7617) — skipping auth`
+        )
+      } else {
+        options.auth = `${this.stationInfo.supervisionUser}:${this.stationInfo.supervisionPassword}`
+      }
     }
     if (params.closeOpened) {
       this.closeWSConnection()

diff --git a/ui/common/src/config/schema.ts b/ui/common/src/config/schema.ts
index 8ec002025ed4dc1fbb7b0c9a0fea06c4429d801d..5c5ca017be377aeb34585e39518184e30b4e4ae5 100644 (file)
--- a/ui/common/src/config/schema.ts
+++ b/ui/common/src/config/schema.ts
@@ -7,7 +7,10 @@ export const authenticationConfigSchema = z
     enabled: z.boolean(),
     password: z.string().optional(),
     type: z.enum(AuthenticationType),
-    username: z.string().optional(),
+    username: z
+      .string()
+      .regex(/^[^:]*$/, 'must not contain ":"')
+      .optional(),
   })
   .refine(
     data =>