{"record":{"id":"ee21fb7c4d7a15b1","repo":"snail007/goproxy","slug":"authorization-data-error-err-s","errorCode":null,"errorMessage":"authorization data error,ERR:%s","messagePattern":"authorization data error,ERR:(.+?)","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"utils/structs.go","lineNumber":320,"sourceCode":"\treturn\n}\nfunc (req *HTTPRequest) IsHTTPS() bool {\n\treturn req.Method == \"CONNECT\"\n}\n\nfunc (req *HTTPRequest) BasicAuth() (err error) {\n\n\t//log.Printf(\"request :%s\", string(b[:n]))\n\tauthorization, err := req.getHeader(\"Authorization\")\n\tif err != nil {\n\t\tfmt.Fprint((*req.conn), \"HTTP/1.1 401 Unauthorized\\r\\nWWW-Authenticate: Basic realm=\\\"\\\"\\r\\n\\r\\nUnauthorized\")\n\t\tCloseConn(req.conn)\n\t\treturn\n\t}\n\t//log.Printf(\"Authorization:%s\", authorization)\n\tbasic := strings.Fields(authorization)\n\tif len(basic) != 2 {\n\t\terr = fmt.Errorf(\"authorization data error,ERR:%s\", authorization)\n\t\tCloseConn(req.conn)\n\t\treturn\n\t}\n\tuser, err := base64.StdEncoding.DecodeString(basic[1])\n\tif err != nil {\n\t\terr = fmt.Errorf(\"authorization data parse error,ERR:%s\", err)\n\t\tCloseConn(req.conn)\n\t\treturn\n\t}\n\tauthOk := (*req.basicAuth).Check(string(user))\n\t//log.Printf(\"auth %s,%v\", string(user), authOk)\n\tif !authOk {\n\t\tfmt.Fprint((*req.conn), \"HTTP/1.1 401 Unauthorized\\r\\n\\r\\nUnauthorized\")\n\t\tCloseConn(req.conn)\n\t\terr = fmt.Errorf(\"basic auth fail\")\n\t\treturn\n\t}\n\treturn","sourceCodeStart":302,"sourceCodeEnd":338,"githubUrl":"https://github.com/snail007/goproxy/blob/e6d6a821db80e7f47ee6e981a144984e1d4ddb3d/utils/structs.go#L302-L338","documentation":"BasicAuth extracts the Authorization header and expects exactly two whitespace-separated fields: the scheme (Basic) and the base64 credentials. If strings.Fields(authorization) does not yield exactly 2 fields, it throws \"authorization data error,ERR:%s\" with the raw header value, closes the connection, and returns. The 401-with-WWW-Authenticate challenge is only sent when the header is missing entirely — a malformed header just errors out.","triggerScenarios":"Calling NewHTTPRequest on a proxy with basic auth enabled when the client sends a malformed Authorization header: only the scheme (\"Basic\") with no credential, extra tokens (\"Basic user:pass extra\"), or a custom header value without the two-field scheme+token shape.","commonSituations":"Clients with hand-crafted Authorization headers (typos, missing base64); middleware or API gateways rewriting/adding Authorization fields; double Authorization headers merged into one value; clients sending raw \"user:pass\" without base64 or scheme.","solutions":["Check the ERR payload in the error (it contains the exact header value) and fix the client to send `Authorization: Basic base64(user:pass)`.","Verify the client encodes credentials with standard base64 of \"username:password\" (e.g. `echo -n 'user:pass' | base64`) and prefixes them with \"Basic \".","Check for reverse proxies/middleware that mangle or duplicate the Authorization header; strip extra fields upstream.","Ensure only one Authorization header is sent — combined values break the two-field expectation."],"exampleFix":"// before (client)\nreq.Header.Set(\"Authorization\", \"myuser:mypass\")\n\n// after (client)\nreq.SetBasicAuth(\"myuser\", \"mypass\") // -> Authorization: Basic bXl1c2VyOm15cGFzcw==","handlingStrategy":"validation","validationCode":"// client-side pre-check: header must be exactly 'Basic <b64>'\ntok := req.Header.Get(\"Authorization\")\nfields := strings.Fields(tok)\nif len(fields) != 2 || fields[0] != \"Basic\" {\n\treturn errors.New(\"Authorization must be exactly: Basic base64(user:pass)\")\n}\nif _, err := base64.StdEncoding.DecodeString(fields[1]); err != nil {\n\treturn fmt.Errorf(\"credentials are not valid standard base64: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"_, err := utils.NewHTTPRequest(conn, bufSize, true, auth)\nif err != nil && strings.HasPrefix(err.Error(), \"authorization data error\") {\n\tlog.Printf(\"client sent malformed Authorization header: %v\", err)\n\t// optionally write a 400/401 before closing; conn already closed by library\n}","preventionTips":["Always build the header with req.SetBasicAuth(user, pass) instead of hand-concatenation.","Encode exactly \"username:password\" with standard base64 (padding included).","Check upstream proxies/gateways don't add, merge, or rewrite Authorization headers.","Include the raw header in your own logs (redacted) to debug malformed values quickly."],"tags":["http","auth","basic-auth","go"],"backgroundTag":"basic-auth-header-malformed","analyzedSha":"e6d6a821db80e7f47ee6e981a144984e1d4ddb3d","analyzedAt":"2026-09-03T15:32:42.750Z","contentChangedAt":"2026-09-03T15:32:42.750Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}