(no subject)

[torkell]

Hmm, Opera doesn't seem to like doing HTTP auth with a password with high ASCII (ÁÉÍÓÚ and friends). Curious. I thought HTTP was supposed to be 8-bit safe, and given that the password will be Base64 encoded anyway (if not hashed) they've got no excuse.

Edit: Well, either I'm mistyping the password or Firefox doesn't like them either (mistyped, Firefox works. Opera doesn't). How odd. Lemme check the RFC...

...yep, the username is defined as being 8-bit text excluding a ':' and the password is defined as any valid 8-bit text. The only characters not permitted are non-white-space control codes (0 .. 31). The spec even says to assume ISO-8859-1 for high ASCII.

Right, let's have a look with a packet sniffer...

...ah-hah! Opera transmits accented characters in some sort of multi-byte encoding (probably UTF-8), and there doesn't appear to be a setting to change this. Bad Opera.

Comments

[ralesk.livejournal.com]

This is the popup window thingy that leads you to a 401 if you fail?

[torkell]

Yep, that's the one. There's two ways of using it - horribly insecure, and slightly insecure - but it works well and is part of the HTTP spec, so pretty much everything supports it. I use it on my admin section as it doesn't need any server-side scripting to work.

[ralesk.livejournal.com]

Ahhh, hmm, can you set a charset=iso-8859-1 somehow in this?  I never used it, so I have no idea about how it works, what HTTP headers are in work here, etc.  Could be a way out though.

[torkell]

I don't think I can set one specifically for that header. I do know that I'm sending "Content-Type: text/html; charset=iso-8859-1", so Opera has no excuse. I'll have to raise it with the devs at some point.