{"record":{"id":"ed2e81aa3afab0c8","repo":"snail007/goproxy","slug":"authorization-data-parse-error-err-s","errorCode":null,"errorMessage":"authorization data parse error,ERR:%s","messagePattern":"authorization data parse error,ERR:(.+?)","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"utils/structs.go","lineNumber":326,"sourceCode":"func (req *HTTPRequest) BasicAuth() (err error) {\n\n\t//log.Printf(\"request :%s\", string(b[:n]))\n\tauthorization, err := req.getHeader(\"Authorization\")\n\tif err != nil {\n\t\tfmt.Fprint((*req.conn), \"HTTP/1.1 401 Unauthorized\\r\\nWWW-Authenticate: Basic realm=\\\"\\\"\\r\\n\\r\\nUnauthorized\")\n\t\tCloseConn(req.conn)\n\t\treturn\n\t}\n\t//log.Printf(\"Authorization:%s\", authorization)\n\tbasic := strings.Fields(authorization)\n\tif len(basic) != 2 {\n\t\terr = fmt.Errorf(\"authorization data error,ERR:%s\", authorization)\n\t\tCloseConn(req.conn)\n\t\treturn\n\t}\n\tuser, err := base64.StdEncoding.DecodeString(basic[1])\n\tif err != nil {\n\t\terr = fmt.Errorf(\"authorization data parse error,ERR:%s\", err)\n\t\tCloseConn(req.conn)\n\t\treturn\n\t}\n\tauthOk := (*req.basicAuth).Check(string(user))\n\t//log.Printf(\"auth %s,%v\", string(user), authOk)\n\tif !authOk {\n\t\tfmt.Fprint((*req.conn), \"HTTP/1.1 401 Unauthorized\\r\\n\\r\\nUnauthorized\")\n\t\tCloseConn(req.conn)\n\t\terr = fmt.Errorf(\"basic auth fail\")\n\t\treturn\n\t}\n\treturn\n}\nfunc (req *HTTPRequest) getHTTPURL() (URL string, err error) {\n\tif !strings.HasPrefix(req.hostOrURL, \"/\") {\n\t\treturn req.hostOrURL, nil\n\t}\n\t_host, err := req.getHeader(\"host\")","sourceCodeStart":308,"sourceCodeEnd":344,"githubUrl":"https://github.com/snail007/goproxy/blob/e6d6a821db80e7f47ee6e981a144984e1d4ddb3d/utils/structs.go#L308-L344","documentation":"BasicAuth takes the second field of the Authorization header and decodes it with base64.StdEncoding.DecodeString. If the credential token is not valid standard base64, it throws \"authorization data parse error,ERR:%s\" wrapping the decode error, closes the connection, and returns.","triggerScenarios":"Calling NewHTTPRequest with basic auth enabled when the client sends an Authorization header like \"Basic <token>\" where <token> contains characters outside the standard base64 alphabet (spaces, ':' as in raw user:pass, URL-safe -_ chars, or truncated padding).","commonSituations":"Clients sending raw \"user:pass\" (colon is invalid base64); credentials encoded with URL-safe base64 (RFC 4648 §5, '-'/'_') by a custom client; token truncated by an intermediate device or header length limit; missing '=' padding from hand-rolled encoders.","solutions":["Re-encode credentials as standard base64: `printf 'user:pass' | base64` and send `Authorization: Basic <result>` (prefer req.SetBasicAuth in Go clients).","Check the wrapped ERR for 'illegal base64 data' — it names the offending character/offset and pinpoints the bad token.","If a custom client uses URL-safe base64, switch it to StdEncoding, or patch the server to try RawURLEncoding/URLEncoding as a fallback.","Ensure nothing upstream truncates or reformats the header (check header size limits on fronting proxies)."],"exampleFix":"// before (server, strict decode only)\nuser, err := base64.StdEncoding.DecodeString(basic[1])\n\n// after (server, tolerant decode)\nuser, err := base64.StdEncoding.DecodeString(basic[1])\nif err != nil {\n\tuser, err = base64.RawURLEncoding.DecodeString(basic[1])\n\tif err != nil {\n\t\terr = fmt.Errorf(\"authorization data parse error,ERR:%s\", err)\n\t\treturn\n\t}\n}","handlingStrategy":"validation","validationCode":"// client-side pre-check before sending credentials\ntoken := base64.StdEncoding.EncodeToString([]byte(user + \":\" + pass))\nif _, err := base64.StdEncoding.DecodeString(token); err != nil {\n\treturn fmt.Errorf(\"credential encoding failed: %w\", err)\n}\nreq.Header.Set(\"Authorization\", \"Basic \"+token)","typeGuard":"func isStandardBase64(s string) bool {\n\t_, err := base64.StdEncoding.DecodeString(s)\n\treturn err == nil\n}","tryCatchPattern":"_, err := utils.NewHTTPRequest(conn, bufSize, true, auth)\nif err != nil && strings.HasPrefix(err.Error(), \"authorization data parse error\") {\n\tlog.Printf(\"Authorization token is not valid standard base64: %v\", err)\n\t// advise client to re-encode with base64.StdEncoding\n}","preventionTips":["Use req.SetBasicAuth() (Go) or equivalent stdlib helpers — never hand-roll the encoding.","Avoid URL-safe base64 (-/_) for HTTP Basic credentials; the server uses StdEncoding.","Beware double-encoding: encoding an already-encoded token also decodes to garbage.","Check intermediaries aren't truncating long Authorization headers."],"tags":["http","auth","base64","basic-auth","go"],"backgroundTag":"invalid-base64-credentials","analyzedSha":"e6d6a821db80e7f47ee6e981a144984e1d4ddb3d","analyzedAt":"2026-09-03T15:32:42.750Z","contentChangedAt":"2026-09-03T15:32:42.750Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}