From: Jérôme Benoit <jerome.benoit@sap.com>
Date: Wed, 22 Apr 2026 20:26:13 +0000 (+0200)
Subject: fix(ui-server): reject colon in configured authentication username (RFC 7617)
X-Git-Tag: cli@v4.5.0~4
X-Git-Url: https://git.piment-noir.org/?a=commitdiff_plain;h=697f7af1b98ad9c93194bf77361d613469126da4;p=e-mobility-charging-stations-simulator.git

fix(ui-server): reject colon in configured authentication username (RFC 7617)

Throw at startup if uiServer.authentication.username contains ':'
to prevent silent auth failures from malformed Basic Auth headers.
---

diff --git a/src/charging-station/ui-server/UIServerFactory.ts b/src/charging-station/ui-server/UIServerFactory.ts
index d5f17a13..1afc6959 100644
--- a/src/charging-station/ui-server/UIServerFactory.ts
+++ b/src/charging-station/ui-server/UIServerFactory.ts
@@ -42,6 +42,14 @@ export class UIServerFactory {
         `'${uiServerConfiguration.authentication.type}' authentication type with application protocol type '${uiServerConfiguration.type}' is not supported in '${ConfigurationSection.uiServer}' configuration section`
       )
     }
+    if (
+      uiServerConfiguration.authentication?.enabled === true &&
+      uiServerConfiguration.authentication.username?.includes(':') === true
+    ) {
+      throw new BaseError(
+        `Authentication username in '${ConfigurationSection.uiServer}' configuration section must not contain ':' (RFC 7617)`
+      )
+    }
     if (
       uiServerConfiguration.authentication?.enabled !== true &&
       !isLoopback(uiServerConfiguration.options?.host ?? '')