Basic authentication to backend fails when special characters are contained in the username or password

Products

• CA API Gateway

Issue/Introduction

When a consumer calls an API with basic authentication in a layer7 gateway environment and this username or password contains a special character the basic authentication is failing.

The password contained in this case was  ‘£' (pound sign).  This request is then routed to a layer7 DMZ gateway which fails to authenticate the request.

At the DMZ gateway, the authentication  header of the incoming message contains a base64 encoded username/password string. Something apparently went wrong when encoding this string.  After decoding the received string, the '£' symbol is missing.

Environment

CA API Gateway 11.x

Resolution

The problem is not that ‘£' (pound sign) is missing but the encoding is not UTF-8, if you take the same encoded string and you decode it with US-ANSI or ISO-8859-1 it will show the £' (pound sign) .

The API gateway is using the default ISO-8859-1 encoding for the authorization header as defined in the RFC. This could cause problem with clients or backends which send the authorization header as a UTF8 encoded string. 

As a workaround for the routing to a backend which require UTF8 create the authorization header not in the routing assertion but set this to no authentication and create the encoded string using the encode/decode assertion and add this to the request header. 

Supporting UTF8 for authorization header is on the feature list for a future release of the gateway.