HTTP/HTTPS 基本认证 : colon in username

Question

这可能是一个基本问题，但是当有 HTTP 或 HTTPS 基本身份验证时，用户名中是否可以有冒号(“:”)？如果没有，我们有办法逃避冒号吗？

Answer 1

RFC https://www.rfc-editor.org/rfc/rfc2617#section-2明确指出用户名不得包含冒号:

To receive authorization, the client sends the userid and password, separated by a single colon (":") character, within a base64 [7] encoded string in the credentials.`

basic-credentials = base64-user-pass

base64-user-pass = <base64 [4] encoding of user-pass, except not limited to 76 char/line>

user-pass = userid ":" password

userid = * <TEXT excluding ":">

password = *TEXT

基于此，无法在用户名中使用冒号。