From 697f7af1b98ad9c93194bf77361d613469126da4 Mon Sep 17 00:00:00 2001 From: =?utf8?q?J=C3=A9r=C3=B4me=20Benoit?= Date: Wed, 22 Apr 2026 22:26:13 +0200 Subject: [PATCH] fix(ui-server): reject colon in configured authentication username (RFC 7617) Throw at startup if uiServer.authentication.username contains ':' to prevent silent auth failures from malformed Basic Auth headers. --- src/charging-station/ui-server/UIServerFactory.ts | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/charging-station/ui-server/UIServerFactory.ts b/src/charging-station/ui-server/UIServerFactory.ts index d5f17a13..1afc6959 100644 --- a/src/charging-station/ui-server/UIServerFactory.ts +++ b/src/charging-station/ui-server/UIServerFactory.ts @@ -42,6 +42,14 @@ export class UIServerFactory { `'${uiServerConfiguration.authentication.type}' authentication type with application protocol type '${uiServerConfiguration.type}' is not supported in '${ConfigurationSection.uiServer}' configuration section` ) } + if ( + uiServerConfiguration.authentication?.enabled === true && + uiServerConfiguration.authentication.username?.includes(':') === true + ) { + throw new BaseError( + `Authentication username in '${ConfigurationSection.uiServer}' configuration section must not contain ':' (RFC 7617)` + ) + } if ( uiServerConfiguration.authentication?.enabled !== true && !isLoopback(uiServerConfiguration.options?.host ?? '') -- 2.53.0