{"record":{"id":"2e6ff4e5a7a80986","repo":"yudai/gotty","slug":"internal-server-error-2e6ff4","errorCode":null,"errorMessage":"Internal Server Error","messagePattern":"Internal Server Error","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"server/middleware.go","lineNumber":38,"sourceCode":"\t\t// todo add version\n\t\tw.Header().Set(\"Server\", \"GoTTY\")\n\t\thandler.ServeHTTP(w, r)\n\t})\n}\n\nfunc (server *Server) wrapBasicAuth(handler http.Handler, credential string) http.Handler {\n\treturn http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n\t\ttoken := strings.SplitN(r.Header.Get(\"Authorization\"), \" \", 2)\n\n\t\tif len(token) != 2 || strings.ToLower(token[0]) != \"basic\" {\n\t\t\tw.Header().Set(\"WWW-Authenticate\", `Basic realm=\"GoTTY\"`)\n\t\t\thttp.Error(w, \"Bad Request\", http.StatusUnauthorized)\n\t\t\treturn\n\t\t}\n\n\t\tpayload, err := base64.StdEncoding.DecodeString(token[1])\n\t\tif err != nil {\n\t\t\thttp.Error(w, \"Internal Server Error\", http.StatusInternalServerError)\n\t\t\treturn\n\t\t}\n\n\t\tif credential != string(payload) {\n\t\t\tw.Header().Set(\"WWW-Authenticate\", `Basic realm=\"GoTTY\"`)\n\t\t\thttp.Error(w, \"authorization failed\", http.StatusUnauthorized)\n\t\t\treturn\n\t\t}\n\n\t\tlog.Printf(\"Basic Authentication Succeeded: %s\", r.RemoteAddr)\n\t\thandler.ServeHTTP(w, r)\n\t})\n}\n","sourceCodeStart":20,"sourceCodeEnd":52,"githubUrl":"https://github.com/yudai/gotty/blob/a080c85cbc59226c94c6941ad8c395232d72d517/server/middleware.go#L20-L52","documentation":"GoTTY's wrapBasicAuth middleware in server/middleware.go:38 returns HTTP 500 'Internal Server Error' when the Base64 portion of the Authorization: Basic header cannot be decoded with base64.StdEncoding.DecodeString. This is a misclassification on the server's part: a malformed credential from the client is a client error (400/401), not a server fault. It means the header's payload contained characters outside the standard Base64 alphabet or had invalid length/padding.","triggerScenarios":"A request carries 'Authorization: Basic <token>' where <token> is not valid standard Base64: URL-safe base64 used instead of standard (- and _ instead of + and /), missing '=' padding, whitespace or a trailing newline embedded in the token, a colon-containing raw 'user:pass' sent unencoded, or a token that was double-encoded/truncated by a proxy.","commonSituations":"Developers hand-crafting the header with `base64 -w0` vs raw encoding mismatches, clients using base64url (JWT-style) encoding, curl with a password containing special characters that break shell quoting, reverse proxies or API gateways re-encoding/stripping the Authorization header, or clients sending 'Basic' plus raw credentials without encoding at all.","solutions":["Fix the client to send proper standard Base64 of 'username:password', e.g. curl -u user:pass or printf 'user:pass' | base64 (no wrapping/newlines)","Check for and replace URL-safe base64 (-, _) with standard base64 (+, /) and correct padding in the token","Verify no proxy or gateway is mangling the Authorization header; compare the header seen by the server (add logging) with what the client sends","Patch the middleware to return http.StatusBadRequest or 401 with WWW-Authenticate instead of 500 for decode failures"],"exampleFix":"// before\ntoken := r.Header.Get(\"Authorization\") // Basic dXNlcnBhc3M  (unencoded / wrong alphabet)\n// server responds 500 Internal Server Error\n\n// after\nimport \"encoding/base64\"\nheader := base64.StdEncoding.EncodeToString([]byte(\"user:pass\"))\nreq.Header.Set(\"Authorization\", \"Basic \"+header) // Basic dXNlcjpwYXNz","handlingStrategy":"validation","validationCode":"func validBasicHeader(h string) bool {\n\tparts := strings.SplitN(h, \" \", 2)\n\tif len(parts) != 2 || !strings.EqualFold(parts[0], \"Basic\") {\n\t\treturn false\n\t}\n\t_, err := base64.StdEncoding.DecodeString(strings.TrimSpace(parts[1]))\n\treturn err == nil\n}","typeGuard":"func isBase64(s string) bool {\n\t_, err := base64.StdEncoding.DecodeString(s)\n\treturn err == nil\n}","tryCatchPattern":null,"preventionTips":["Always build the header with a helper (req.SetBasicAuth or base64.StdEncoding.EncodeToString([]byte(\"user:pass\"))) instead of hand-writing tokens","Never send URL-safe (base64url) encoding for Basic auth; use standard Base64 with padding","Trim newlines/whitespace from base64 output (e.g. `base64 -w0` on Linux)","Pre-verify tokens with a decode check before deploying client config"],"tags":["http","base64","authentication","gotty"],"backgroundTag":"invalid-basic-auth-header","analyzedSha":"a080c85cbc59226c94c6941ad8c395232d72d517","analyzedAt":"2026-09-02T16:42:38.150Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T21:17:11.164Z"}