taler-typescript-core

commit 493f272d691be8456605bca2e296e51257af7ae4
parent 678b8d798d34af1e0d9b1adb79d3a3c4e813734a
Author: Hernâni Marques <hernani@vecirex.net>
Date:   Fri, 17 Jul 2026 23:15:31 +0200

fix/taler-merchant-webui (11340): mitigate HTTP 401 by enforcing lowercase username in frontend

Diffstat:
M
packages/taler-merchant-webui/src/paths/login/index.tsx
 | 
13
+++++++++----

1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/packages/taler-merchant-webui/src/paths/login/index.tsx b/packages/taler-merchant-webui/src/paths/login/index.tsx
@@ -104,19 +104,23 @@ export function LoginPage({ showCreateAccount, focus }: Props): VNode {
   const login = actionHandler(
     /*login*/
     async (ct, usr: string, pwd: Password, challengeIds?: string[]) => {
-      const api = getInstanceForUsername(usr);
+      // #11340: Basic-auth username is case-sensitive; lowercase avoids 401.
+      const id = usr.toLowerCase();
+      const api = getInstanceForUsername(id);
       const resp = await api.createAccessToken(
-        usr,
+        id,
         pwd.__pwd,
         FOREVER_REFRESHABLE_TOKEN(i18n.str`Logged in`),
         { challengeIds },
       );
       return resp;
     },
-    !value.username || !value.password ? undefined : [value.username, pwd],
+    !value.username || !value.password
+      ? undefined
+      : [value.username.toLowerCase(), pwd],
   );
   login.onSuccess = (success, usr) => {
-    logIn(usr, success.access_token);
+    logIn(usr.toLowerCase(), success.access_token);
   };
   login.onFail = showError(i18n.str`Login failed`, (fail) => {
     switch (fail.case) {
@@ -182,6 +186,7 @@ export function LoginPage({ showCreateAccount, focus }: Props): VNode {
                 focus={focus}
                 tooltip={i18n.str`Instance name.`}
                 autoComplete="username"
+                fromStr={(s) => s.toLowerCase()}
               />
               <InputPassword<Form>
                 name="password"