fix: bad authorization format crash with 500

apps/emqx_management/src/emqx_management.app.src

@@ -1,6 +1,6 @@
 {application, emqx_management,
  [{description, "EMQ X Management API and CLI"},
-  {vsn, "4.3.13"}, % strict semver, bump manually!
+  {vsn, "4.3.11"}, % strict semver, bump manually!
   {modules, []},
   {registered, [emqx_management_sup]},
   {applications, [kernel,stdlib,minirest]},

apps/emqx_management/src/emqx_mgmt_http.erl

@@ -118,9 +118,10 @@ handle_request(_Method, _Path, Req) ->
     cowboy_req:reply(400, #{<<"content-type">> => <<"text/plain">>}, <<"Not found.">>, Req).
 
 authorize_appid(Req) ->
-    case cowboy_req:parse_header(<<"authorization">>, Req) of
+    try
-        {basic, AppId, AppSecret} -> emqx_mgmt_auth:is_authorized(AppId, AppSecret);
+        {basic, AppId, AppSecret} = cowboy_req:parse_header(<<"authorization">>, Req),
-         _  -> false
+        emqx_mgmt_auth:is_authorized(AppId, AppSecret)
+    catch _:_ -> false
     end.
 
 -ifdef(EMQX_ENTERPRISE).

lib-ce/emqx_dashboard/src/emqx_dashboard.erl

@@ -103,17 +103,17 @@ is_authorized(Req) ->
 is_authorized("/api/v4/auth", _Req) ->
     true;
 is_authorized(_Path, Req) ->
-    case cowboy_req:parse_header(<<"authorization">>, Req) of
+    try
-        {basic, Username, Password} ->
+        {basic, Username, Password} = cowboy_req:parse_header(<<"authorization">>, Req),
-            case emqx_dashboard_admin:check(iolist_to_binary(Username),
+        case emqx_dashboard_admin:check(iolist_to_binary(Username), iolist_to_binary(Password)) of
-                                            iolist_to_binary(Password)) of
+            ok -> true;
-                ok -> true;
+            {error, Reason} ->
-                {error, Reason} ->
+                ?LOG(error, "[Dashboard] Authorization Failure: username=~s, reason=~p",
-                    ?LOG(error, "[Dashboard] Authorization Failure: username=~s, reason=~p",
+                    [Username, Reason]),
-                                [Username, Reason]),
+                false
-                    false
+        end
-            end;
+    catch _:_ -> %% bad authorization header will crash.
-         _  -> false
+        false
     end.
 
 filter(#{app := emqx_modules}) -> true;