Merge pull request #1319 from mickem/bug/1318_fixed_password_header_should_be_case_insensetive

Fixed #1318 https headers should be case-insensitive

Author: mickem

.github/workflows/build-windows-legacy.yml

@@ -40,7 +40,14 @@ env:
 
 jobs:
   build:
-    runs-on: windows-latest
+    # Pinned to windows-2022 (not windows-latest): the legacy XP build needs
+    # the v141_xp toolset, the Windows 8.1 SDK, the "Visual Studio 17"
+    # (VS 2022) cmake generator, and ./.github/actions/update-msvc installs
+    # components into ...\Microsoft Visual Studio\2022\Enterprise. The
+    # windows-latest image has moved to Visual Studio 18, which ships none of
+    # those, so ilammy/msvc-dev-cmd fails with "Toolset directory for version
+    # '14.1' was not found".
+    runs-on: windows-2022
     outputs:
       platform: ${{ steps.setup.outputs.platform }}
 

.github/workflows/build-windows.yml

@@ -40,7 +40,14 @@ env:
 
 jobs:
   build:
-    runs-on: windows-latest
+    # Pinned to windows-2022 (not windows-latest): this build targets the
+    # v141 toolset via vcvars 14.1, builds with the "Visual Studio 17"
+    # (VS 2022) cmake generator, and ./.github/actions/update-msvc installs
+    # components into ...\Microsoft Visual Studio\2022\Enterprise. The
+    # windows-latest image has moved to Visual Studio 18, which ships none of
+    # those, so ilammy/msvc-dev-cmd fails with "Toolset directory for version
+    # '14.1' was not found".
+    runs-on: windows-2022
     outputs:
       platform: ${{ steps.setup.outputs.platform }}
 

libs/mongoose-cpp/Request.h

@@ -10,6 +10,8 @@
 #pragma warning(disable : 4251)
 #endif
 
+#include <algorithm>
+#include <cctype>
 #include <map>
 #include <string>
 #include <vector>
@@ -22,7 +24,17 @@ class NSCAPI_EXPORT Request {
  public:
   typedef std::pair<std::string, std::string> arg_entry;
   typedef std::vector<arg_entry> arg_vector;
-  typedef std::map<std::string, std::string> headers_type;
+
+  // HTTP header names are case-insensitive (RFC 7230 3.2), so the header map
+  // compares keys without regard to case. This lets clients send e.g. either
+  // `password` or `Password` and have it resolve to the same entry.
+  struct ci_less {
+    bool operator()(const std::string& lhs, const std::string& rhs) const {
+      return std::lexicographical_compare(lhs.begin(), lhs.end(), rhs.begin(), rhs.end(),
+                                          [](unsigned char a, unsigned char b) { return std::tolower(a) < std::tolower(b); });
+    }
+  };
+  typedef std::map<std::string, std::string, ci_less> headers_type;
 
   Request(std::string ip, bool is_ssl, std::string method, std::string url, std::string query, headers_type headers, std::string data);
 

libs/mongoose-cpp/Request_test.cpp

@@ -38,8 +38,9 @@ TEST(Request, HasVariableChecksHeaders) {
   EXPECT_TRUE(r.hasVariable("Host"));
   EXPECT_TRUE(r.hasVariable("X-Test"));
   EXPECT_FALSE(r.hasVariable("Missing"));
-  // Map is case-sensitive on the contained keys.
-  EXPECT_FALSE(r.hasVariable("host"));
+  // Header names are case-insensitive (RFC 7230 3.2).
+  EXPECT_TRUE(r.hasVariable("host"));
+  EXPECT_TRUE(r.hasVariable("x-test"));
 }
 
 TEST(Request, ReadHeaderReturnsValueOrEmpty) {
@@ -49,6 +50,17 @@ TEST(Request, ReadHeaderReturnsValueOrEmpty) {
   EXPECT_EQ(r.readHeader("Missing"), "");
 }
 
+TEST(Request, ReadHeaderIsCaseInsensitive) {
+  // Clients send the legacy credential header as either `password` or
+  // `Password` (e.g. Go's net/http canonicalizes to `Password`); both must
+  // resolve to the same value. See session_manager_interface::is_logged_in.
+  const Request::headers_type h{{"Password", "secret"}};
+  const auto r = make_request("GET", "/", "", h);
+  EXPECT_EQ(r.readHeader("password"), "secret");
+  EXPECT_EQ(r.readHeader("Password"), "secret");
+  EXPECT_EQ(r.readHeader("PASSWORD"), "secret");
+}
+
 TEST(Request, ReadHeaderDoesNotMutateHeaders) {
   const Request::headers_type h{{"Host", "example.com"}};
   auto r = make_request("GET", "/", "", h);