From 2829f7b4859181c91016e4a757bb8ea23396f075 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Sun, 8 Feb 2026 06:47:16 -0600 Subject: [PATCH] [dashboard] Handle malformed Basic Auth headers gracefully Wrap base64 decode and split in try/except so malformed Authorization headers return a clean 401 instead of an unhandled exception producing a 500 response with stack trace in logs. Catches ValueError (covers binascii.Error from b64decode) and UnicodeDecodeError (from .decode()). --- esphome/dashboard/web_server.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/esphome/dashboard/web_server.py b/esphome/dashboard/web_server.py index da50279864..52e16e1ad7 100644 --- a/esphome/dashboard/web_server.py +++ b/esphome/dashboard/web_server.py @@ -120,8 +120,11 @@ def is_authenticated(handler: BaseHandler) -> bool: if auth_header := handler.request.headers.get("Authorization"): assert isinstance(auth_header, str) if auth_header.startswith("Basic "): - auth_decoded = base64.b64decode(auth_header[6:]).decode() - username, password = auth_decoded.split(":", 1) + try: + auth_decoded = base64.b64decode(auth_header[6:]).decode() + username, password = auth_decoded.split(":", 1) + except (ValueError, UnicodeDecodeError): + return False return settings.check_password(username, password) return handler.get_secure_cookie(AUTH_COOKIE_NAME) == COOKIE_AUTHENTICATED_YES