Full diff patch attached (I'm new to both github and mojolicious—let me know if this is correct
protocol or not).
diff --git a/lib/Mojolicious/Plugin/BasicAuth.pm b/lib/Mojolicious/Plugin/BasicAuth.pm
index a92897e..00add8f 100644
--- a/lib/Mojolicious/Plugin/BasicAuth.pm
+++ b/lib/Mojolicious/Plugin/BasicAuth.pm
@@ -28,7 +28,7 @@ sub register {
if !$auth and !$callback;
# Verification within callback
- return 1 if $callback and $callback->(split /:/, $auth);
+ return 1 if $callback and $callback->(split /:/, $auth, 2);
# Verified with realm => username => password syntax
return 1 if $auth eq ($username || '') . ":$password";
diff --git a/t/auth.t b/t/auth.t
index 35e1cdc..bdb9892 100644
--- a/t/auth.t
+++ b/t/auth.t
@@ -6,7 +6,7 @@ use Mojo::ByteStream;
# Make sure sockets are working
plan skip_all => 'working sockets required for this test!'
unless Mojo::IOLoop->new->generate_port; # Test server
-plan tests => 39;
+plan tests => 45;
# Lite app
use Mojolicious::Lite;
@@ -56,6 +56,16 @@ get '/under-bridge' => sub {
shift->render(text => 'authorized');
};
+under sub {
+ my $self = shift;
+ return $self->basic_auth(
+ realm => sub { return 1 if "@_" eq 'username passw:ord' });
+};
+
+get '/under-bridge-colon' => sub {
+ shift->render(text => 'authorized');
+};
+
# Tests
my $t = Test::Mojo->new;
my $encoded;
@@ -92,6 +102,14 @@ chop $encoded;
$t->get_ok('/under-bridge', {Authorization => "Basic $encoded"})
->status_is(401)->content_is('');
+# Under bridge-colon fail
+diag '/under-bridge-colon';
+$encoded = Mojo::ByteStream->new("username:password")->b64_encode->to_string;
+chop $encoded;
+$t->get_ok('/under-bridge-colon', {Authorization => "Basic $encoded"})
+ ->status_is(401)->content_is('');
+
+
# Successes #
# Username, password
@@ -122,3 +140,9 @@ chop $encoded;
$t->get_ok('/under-bridge', {Authorization => "Basic $encoded"})
->status_is(200)->content_is('authorized');
+# Under bridge w/ colon
+diag '/under-bridge-colon';
+$encoded = Mojo::ByteStream->new("username:passw:ord")->b64_encode->to_string;
+chop $encoded;
+$t->get_ok('/under-bridge-colon', {Authorization => "Basic $encoded"})
+ ->status_is(200)->content_is('authorized');
