refactor: improve invalid auth (#356)

diff --git a/src/auth.rs b/src/auth.rs
index 44dc3455a96a39140d1452f885364472e353ef3d..7eb59454a53433ba3bec0609fe76d12fee3b7674 100644 (file)
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -109,11 +109,11 @@ impl AccessControl {
                     }
                     if check_auth(authorization, method.as_str(), &user, pass).is_some() {
                         return (Some(user), paths.find(path, !is_readonly_method(method)));
-                    } else {
-                        return (None, None);
                     }
                 }
             }
+
+            return (None, None);
         }
 
         if method == Method::OPTIONS {

diff --git a/tests/auth.rs b/tests/auth.rs
index 4b0750a8b5378c972d10827eef8a09761b1f263f..34a5d69340bb4da2d3b8c4b8cb3e6534f41a2c84 100644 (file)
--- a/tests/auth.rs
+++ b/tests/auth.rs
@@ -39,6 +39,25 @@ fn auth(#[case] server: TestServer, #[case] user: &str, #[case] pass: &str) -> R
     Ok(())
 }
 
+#[rstest]
+fn invalid_auth(
+    #[with(&["-a", "user:pass@/:rw", "-a", "@/", "-A"])] server: TestServer,
+) -> Result<(), Error> {
+    let resp = fetch!(b"GET", server.url())
+        .basic_auth("user", Some("-"))
+        .send()?;
+    assert_eq!(resp.status(), 401);
+    let resp = fetch!(b"GET", server.url())
+        .basic_auth("-", Some("pass"))
+        .send()?;
+    assert_eq!(resp.status(), 401);
+    let resp = fetch!(b"GET", server.url())
+        .header("Authorization", "Basic Og==")
+        .send()?;
+    assert_eq!(resp.status(), 401);
+    Ok(())
+}
+
 const HASHED_PASSWORD_AUTH: &str =  "user:$6$gQxZwKyWn/ZmWEA2$4uV7KKMnSUnET2BtWTj/9T5.Jq3h/MdkOlnIl5hdlTxDZ4MZKmJ.kl6C.NL9xnNPqC4lVHC1vuI0E5cLpTJX81@/:rw"; // user:pass
 
 #[rstest]