N°9954 - Login-basic incompatible with OAuth2 server

[eespie]

Rebased on support/3.3 from an old branch, this is related to #1018
only for convenience of branch management

[Copilot]

🟡 Changes recommended

Nullable credentials, case-sensitive scheme matching, and colon-containing passwords remain incorrectly handled.

1 open finding

• Guard nullable credentials before destructuring · New

What changed in this PR

Refines Basic-auth detection to avoid claiming OAuth2 Bearer requests.

Changes:

• Validates Basic authorization headers before selecting login mode.
• Adds mode-detection tests for supported credential sources and Bearer tokens.

File	Description
application/​loginbasic.class.inc.php	Refactors Basic credential parsing and detection.
tests/​php-unit-tests/​unitary-tests/​application/​LoginFSM/​LoginBasicTest.php	Adds authentication mode tests.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[greptile-apps]

Confidence Score: 4/5

[Critical impact] Refactors HTTP basic authentication detection and parsing.

Fix the case-sensitive Basic scheme check before merging; it breaks login for valid clients.

Findings

1.  Valid Basic headers get rejected ▶

Summary

The PR makes Basic login detection read credentials before selecting a login mode.

• OAuth bearer headers no longer select Basic login.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Incoming credentials] --> B[Read authorization header or PHP credentials]
  B --> C{Recognized Basic credentials?}
  C -->|Yes| D[Select Basic login]
  C -->|No| E[Leave mode selection to other login paths]
  D --> F[Check username and password]

Loading

_{Reviews (1) · Last reviewed commit: "N°9954 - Login-basic incompatible with O..." · Reviewed by Greptile}