Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

BUG: The Request.ServerVariables("AUTH_PASSWORD") object does not display certain characters from an ASPX page


View products that this article applies to.

Symptoms

When an ASPX page is requested with a password that has characters such as �, �, �, �, �, or �, the Request.ServerVariables("AUTH_PASSWORD") object omits these characters when the password is displayed.

↑ Back to the top


Workaround

To work around the behavior that is described in the "Symptoms" section of this article, follow these steps:
  1. Start Notepad.
  2. Paste the following code in Notepad:
    <%
    	Dim header as string
    	Dim ticket as string		
    	Dim GetAuthPassword as string
    		header=Request.ServerVariables("HTTP_AUTHORIZATION")
    		If  header.StartsWith("Basic") or header ="" then
    			ticket = header.Substring(6)
    			ticket = System.Text.Encoding.Default.GetString(Convert.FromBase64String(ticket))
    			response.write(ticket.Substring((ticket.IndexOf(":")+1)))
    			GetAuthPassword	=ticket.Substring((ticket.IndexOf(":")+1))
    		end if 
    %>
    
    AUTH_USER=<%=Request.ServerVariables("AUTH_USER") %><br>
    AUTH_PAssword=<%=GetAuthPassword%>
  3. Save the file as ExampleASPX.aspx.

    Note ExampleASPX.aspx is a placeholder for the name of the .aspx file.

↑ Back to the top


Status

Microsoft has confirmed that this is a bug in the Microsoft products that are listed in the "Applies to" section of this article.

↑ Back to the top


More information

Steps to reproduce the behavior

Create a user

  1. At a command prompt, create a local user by using the following command:
    net user MyUser "Test��123" /add
  2. Add the user to the Administrators group.

Create an ASP page

  1. Start Notepad.
  2. Paste the following code in Notepad:
    AUTH_USER=<%=Request.ServerVariables("AUTH_USER") %><br>
    AUTH_Password=<%=Request.ServerVariables("AUTH_PASSWORD") %>
  3. Save the page as ExampleASP.asp.

    Note ExampleASP.asp is a placeholder for the name of the .asp file.

Create an ASPX page

  1. In Notepad, paste the following code:
    AUTH_USER=<%=Request.ServerVariables("AUTH_USER") %><br>
    AUTH_PASSWORD=<%=Request.ServerVariables("AUTH_PASSWORD") %><br>
  2. Save the page as ExampleASPX.aspx.

    Note ExampleASPX.aspx is a placeholder for the name of the .aspx file.

Put the files in a folder

Create a folder in C:\Inetpub\wwwroot that is named Test, and then put the created files to this folder.

Note Test is a placeholder for the name of the folder.

Create a virtual directory in Internet Information Services (IIS)

  1. Click Start, point to Settings, and then click Control Panel.
  2. Double-click Administrative Tools, and then double-click Internet Services Manager.
  3. In the Internet Information Services window, double-click the computer name, and then click Default Web Site.
  4. On the Action menu, point to New, and then click Virtual Directory.
  5. Complete the Virtual Directory Creation Wizard. Map the folder Test to a virtual directory in IIS. Name the virtual directory in IIS as TestApplication.

    Note TestApplication is a placeholder for the virtual directory name in IIS.

Set the directory security of the virtual directory

  1. In IIS, click the virtual directory in IIS that was created in the "Create a virtual directory in Internet Information Services (IIS)" section of this article.
  2. On the Action menu, click Properties. The TestApplication Properties dialog box appears.
  3. On the Directory Security tab, click Edit under Anonymous access and authentication control. The Authentication Methods dialog box appears.
  4. Click to clear the Anonymous access check box, and then click to select the Basic authentication (password is sent in clear test) check box. A warning message appears.
  5. Click Yes.
  6. Click to clear the Integrated windows authentication check box, and then click OK two times.

Access the ASP page from Internet Explorer

  1. Start Microsoft Internet Explorer.
  2. In the address bar, type the following URL:
    http://WebServerName/TestApplication/ExampleASP.asp
    Note WebServerName is a placeholder for the name of the Web server.
  3. Click Go.
  4. In the dialog box that appears, type MyUser in the User Name box, and then type Test��123 in the Password box.

    Note MyUser is the user name and Test��123 is the password that were created in step 1 of the "Create a user" section of this article.
  5. Click OK.

    Notice that the user name and the password with which the ASP page is being accessed appears correctly.

Access the ASPX page from Internet Explorer

  1. Start Internet Explorer.
  2. In the address bar, type the following URL:
    http://WebServerName/TestApplication/ExampleASPX.aspx
    Note WebServerName is a placeholder for the name of the Web server.
  3. Click Go.
  4. In the dialog box that appears, type MyUser in the User Name box, and then type Test��123 in the Password box.

    Note MyUser is the user name and Test��123 is the password that you created in the "Create a User" section of the article.
  5. Click OK.
Notice that the user name that the ASPX page is accessed with is displayed correctly but that the password that the ASPX page is accessed with appears incorrectly. The characters that are specified in the password are omitted.

↑ Back to the top


Keywords: KB835388, kbbug, kbhttp, kbserver, kbsymbols, kbuser, kbauthentication

↑ Back to the top

Article Info
Article ID : 835388
Revision : 5
Created on : 5/17/2007
Published on : 5/17/2007
Exists online : False
Views : 408