From c17a6de2a6f0431df5bb2650f97011678e6c742a Mon Sep 17 00:00:00 2001
From: Alessandro Ros <aler9.dev@gmail.com>
Date: Sun, 11 May 2025 10:20:57 +0200
Subject: [PATCH] parse HTTP username and password OR token, not both (#4517)

---
 internal/protocols/httpp/credentials.go      | 19 +++++++++++++------
 internal/protocols/httpp/credentials_test.go | 18 ++++++++++++++++++
 2 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/internal/protocols/httpp/credentials.go b/internal/protocols/httpp/credentials.go
index bf597144..751cd33b 100644
--- a/internal/protocols/httpp/credentials.go
+++ b/internal/protocols/httpp/credentials.go
@@ -11,16 +11,23 @@ import (
 func Credentials(h *http.Request) *auth.Credentials {
 	c := &auth.Credentials{}
 
-	c.User, c.Pass, _ = h.BasicAuth()
+	for _, auth := range h.Header["Authorization"] {
+		if strings.HasPrefix(auth, "Bearer ") {
+			// user:pass in Authorization Bearer
+			if parts := strings.Split(auth[len("Bearer "):], ":"); len(parts) == 2 {
+				c.User = parts[0]
+				c.Pass = parts[1]
+				return c
+			}
 
-	if auth := h.Header.Get("Authorization"); strings.HasPrefix(auth, "Bearer ") {
-		if parts := strings.Split(auth[len("Bearer "):], ":"); len(parts) == 2 { // user:pass in Authorization Bearer
-			c.User = parts[0]
-			c.Pass = parts[1]
-		} else { // JWT in Authorization Bearer
+			// JWT in Authorization Bearer
 			c.Token = auth[len("Bearer "):]
+			return c
 		}
 	}
 
+	// user:pass in Authorization Basic
+	c.User, c.Pass, _ = h.BasicAuth()
+
 	return c
 }
diff --git a/internal/protocols/httpp/credentials_test.go b/internal/protocols/httpp/credentials_test.go
index 5f70f5d6..bdc0c5dd 100644
--- a/internal/protocols/httpp/credentials_test.go
+++ b/internal/protocols/httpp/credentials_test.go
@@ -62,4 +62,22 @@ func TestCredentials(t *testing.T) {
 			Token: "testing123",
 		}, c)
 	})
+
+	t.Run("user and pass and token", func(t *testing.T) {
+		h := &http.Request{
+			URL: &url.URL{},
+			Header: http.Header{
+				"Authorization": []string{
+					"Basic bXl1c2VyOm15cGFzcw==",
+					"Bearer testing123",
+				},
+			},
+		}
+
+		c := Credentials(h)
+
+		require.Equal(t, &auth.Credentials{
+			Token: "testing123",
+		}, c)
+	})
 }