{"record":{"id":"e4c6040d83137952","repo":"XX-net/XX-Net","slug":"decode-auth-fail-r","errorCode":null,"errorMessage":"decode auth fail:%r","messagePattern":"decode auth fail:%r","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"code/default/launcher/web_control.py","lineNumber":222,"sourceCode":"        # check for '..', which will leak file\n        if re.search(r'(\\.{2})', self.path) is not None:\n            self.wfile.write(b'HTTP/1.1 404\\r\\n\\r\\n')\n            xlog.warn('%s %s %s haking', self.address_string(), self.command, self.path)\n            return\n\n        if config.webui_auth:\n            auth = self.headers.get(\"Authorization\")\n            if not auth or not auth.startswith(\"Basic \"):\n                return self.send_response(content=\"\", headers={\n                    \"WWW-Authenticate\": 'Basic realm=\"Access to admin\"'\n                }, status=401)\n\n            try:\n                user_pass = base64.b64decode(auth[6:])\n                user_pass = utils.to_str(user_pass)\n                user, password = user_pass.split(\":\")[0:2]\n            except Exception as e:\n                xlog.warn(\"decode auth fail:%r\", e)\n                return self.send_response(content=\"\", headers={\n                    \"WWW-Authenticate\": 'Basic realm=\"Access to admin\"'\n                }, status=401)\n\n            if config.webui_auth.get(user) != password:\n                return self.send_response(content=\"\", headers={\n                    \"WWW-Authenticate\": 'Basic realm=\"Access to admin\"'\n                }, status=401)\n\n        url_path = urlparse(self.path).path\n        if url_path == '/':\n            return self.req_index_handler()\n\n        url_path_list = self.path.split('/')\n        if len(url_path_list) >= 3 and url_path_list[1] == \"module\":\n            module = url_path_list[2]\n            if len(url_path_list) >= 4 and url_path_list[3] == \"control\":\n                if module not in module_init.proc_handler:","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/XX-net/XX-Net/blob/cfa5bc17b67676e467f37ec50766127e0ab5f0aa/code/default/launcher/web_control.py#L204-L240","documentation":"With webui_auth enabled, the Basic auth header's base64 payload failed to decode or split into user:password; the client gets a 401 with WWW-Authenticate after this warning.","triggerScenarios":"Malformed Authorization header (not valid base64, or no ':' separator) — hand-crafted requests, broken proxies stripping/rewriting the header, or browser sending credentials in an unexpected format.","commonSituations":"Typos in scripted curl requests; an intermediary mangling the header; very old browsers with non-Latin credentials.","solutions":["Send a proper Basic header: 'Authorization: Basic ' + base64(user:password).","Ensure the password contains a colon-free format and UTF-8 encoding.","Check no proxy strips Authorization; bypass proxy for localhost."],"exampleFix":"// before\ncurl -H 'Authorization: Basic abc' http://127.0.0.1:8085/\n// after\ncurl -u user:pass http://127.0.0.1:8085/","handlingStrategy":"try-catch","validationCode":"import base64\ndef parse_basic(auth):\n    if not auth or not auth.startswith('Basic '): return None\n    try:\n        s = base64.b64decode(auth[6:]).decode('utf-8')\n        u, p = s.split(':', 1)\n        return u, p\n    except Exception:\n        return None","typeGuard":null,"tryCatchPattern":"try:\n    user, pw = parse_basic(self.headers.get('Authorization'))\nexcept ValueError:\n    return send_401()","preventionTips":["Use standard clients (curl -u, browser prompt).","Avoid colons in passwords.","Ensure no proxy strips Authorization headers."],"tags":["security","authentication","http","base64"],"backgroundTag":"basic-auth-malformed","analyzedSha":"cfa5bc17b67676e467f37ec50766127e0ab5f0aa","analyzedAt":"2026-08-27T19:28:28.225Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}