The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

docs/middleware/basicauth.md (4)

7-10: Tighten wording on whitespace semantics (SP-only between scheme and token).

To prevent ambiguity: explicitly say that only SP (0x20) may separate "Basic" and the token; leading/trailing SP/HTAB are trimmed; any HTAB or SP inside the token is rejected.

Apply this doc tweak:

-Basic Authentication middleware for [Fiber](https://github.com/gofiber/fiber) that provides HTTP basic auth. It calls the next handler for valid credentials and returns [`401 Unauthorized`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401) for missing or invalid credentials, [`400 Bad Request`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/400) for malformed `Authorization` headers, or [`431 Request Header Fields Too Large`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/431) when the header exceeds size limits. Credentials may omit Base64 padding as permitted by RFC 7235's `token68` syntax.
+Basic Authentication middleware for [Fiber](https://github.com/gofiber/fiber) that provides HTTP basic auth. It calls the next handler for valid credentials and returns [`401 Unauthorized`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401) for missing or invalid credentials, [`400 Bad Request`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/400) for malformed `Authorization` headers, or [`431 Request Header Fields Too Large`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/431) when the header exceeds size limits. Only SP (0x20) may separate the `Basic` scheme and token (one or more SPs allowed); leading/trailing SP/HTAB are ignored; any whitespace inside the token is rejected. Credentials may omit Base64 padding as permitted by RFC 7235 `token68`.

---

9-9: Clarify panic timing for invalid charset.

Note it panics during middleware setup (New/configDefault), not at request time.

-Only the `UTF-8` charset is supported; any other value will panic.
+Only the `UTF-8` charset is supported; any other value will panic during middleware initialization.

---

101-106: Disambiguate “case-insensitive” to exclude utf8 (no hyphen).

Readers may assume utf8 is allowed. The code only accepts UTF-8 (case-insensitive, hyphen required).

-| Charset         | `string`                    | Charset sent in the `WWW-Authenticate` header. Only `"UTF-8"` is supported (case-insensitive). | `"UTF-8"` |
+| Charset         | `string`                    | Charset sent in the `WWW-Authenticate` header. Only `"UTF-8"` is supported (case-insensitive; `"utf8"` without hyphen is not allowed). | `"UTF-8"` |

---

109-120: Mention default BadRequest behavior explicitly.

You list BadRequest: nil in the example, but the runtime default returns bare 400 without WWW-Authenticate. Spell that out for users.

 var ConfigDefault = Config{
@@
-    BadRequest:      nil,
+    BadRequest:      nil, // when nil, the middleware responds with 400 without WWW-Authenticate
 }

middleware/basicauth/config.go (2)

107-113: Charset enforcement is correct; consider explicitly rejecting utf8 in docs, not code.

Code canonically accepts only UTF-8 (case-insensitive) and panics otherwise—good. No change needed here; just ensure docs call out that utf8 (no hyphen) is invalid (see docs comment).

---

131-141: Micro: precompute the WWW-Authenticate header string once.

Avoids rebuilding the header on every 401 while keeping behavior identical.

-	if cfg.Unauthorized == nil {
-		cfg.Unauthorized = func(c fiber.Ctx) error {
-			header := "Basic realm=" + strconv.Quote(cfg.Realm)
-			if cfg.Charset != "" {
-				header += ", charset=" + strconv.Quote(cfg.Charset)
-			}
-			c.Set(fiber.HeaderWWWAuthenticate, header)
+	if cfg.Unauthorized == nil {
+		header := "Basic realm=" + strconv.Quote(cfg.Realm)
+		if cfg.Charset != "" {
+			header += ", charset=" + strconv.Quote(cfg.Charset)
+		}
+		cfg.Unauthorized = func(c fiber.Ctx) error {
+			c.Set(fiber.HeaderWWWAuthenticate, header)
 			c.Set(fiber.HeaderCacheControl, "no-store")
 			c.Set(fiber.HeaderVary, fiber.HeaderAuthorization)
 			return c.SendStatus(fiber.StatusUnauthorized)
 		}
 	}

middleware/basicauth/basicauth.go (1)

95-100: Tiny simplification: use strings.Cut for the colon split.

Same behavior, slightly clearer.

-	index := strings.Index(creds, ":")
-	if index == -1 {
+	if index := strings.Index(creds, ":"); index == -1 {
 		return cfg.BadRequest(c)
-	}
-
-	// Get the username and password
-	username := creds[:index]
-	password := creds[index+1:]
+	} else {
+		// Get the username and password
+		username := creds[:index]
+		password := creds[index+1:]
+		// existing CTL check + authorizer continue below...
+		_ = username
+		_ = password
+	}

(Alternatively: u, p, ok := strings.Cut(creds, ":").)

middleware/basicauth/basicauth_test.go (3)

227-259: Whitespace matrix is comprehensive.

Nice coverage of SP vs HTAB and internal-space rejection.

Add a case with leading/trailing HTAB only (no SP) to assert trimming still succeeds:

{"\tBasic " + creds + "\t", fiber.StatusTeapot},

(You already have it; consider also "Basic "+creds+"\t\t".)

---

396-402: Charset panic tests are good; consider adding utf8 (no hyphen) as a negative.

 require.Panics(t, func() { New(Config{Charset: "ISO-8859-1"}) })
+require.Panics(t, func() { New(Config{Charset: "utf8"}) }) // no hyphen should panic
 require.NotPanics(t, func() { New(Config{Charset: "utf-8"}) })
 require.NotPanics(t, func() { New(Config{Charset: "UTF-8"}) })
 require.NotPanics(t, func() { New(Config{}) })

---

227-259: Add a test for custom BadRequest handler.

To lock in the no-challenge behavior and allow custom body/status, add a small test where BadRequest writes a body or different status.

app := fiber.New()
app.Use(New(Config{
  Users: map[string]string{"john": sha256Hash("doe")},
  BadRequest: func(c fiber.Ctx) error {
    c.Set("X-Bad", "1")
    return c.Status(fiber.StatusBadRequest).SendString("bad auth")
  },
}))
// send malformed header and assert status/body/header and no WWW-Authenticate.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/store.go:164-167
Timestamp: 2024-10-02T23:03:31.727Z
Learning: Unit tests in this project use testify require.

Learnt from: sixcolors
PR: gofiber/fiber#2922
File: middleware/cors/utils.go:63-71
Timestamp: 2024-10-08T19:06:06.583Z
Learning: The project uses the testify/assert package for assertions in unit tests.

Learnt from: ReneWerner87
PR: gofiber/fiber#3161
File: app.go:923-932
Timestamp: 2024-11-15T07:56:21.623Z
Learning: In the Fiber framework, breaking changes are acceptable when moving from version 2 to version 3, including modifications to method signatures such as in the `Test` method in `app.go`.

middleware/basicauth/basicauth.go (2)

59-59: Past nit addressed: replaced manual loop with TrimLeft.

You adopted TrimLeft for skipping spaces after the scheme, which improves readability.

---

118-122: Past nit addressed and a tiny micro-optimization idea.

You extracted a named helper (nice). If you want, scan bytes to avoid rune decoding, since non-ASCII is rejected anyway.

-func containsInvalidHeaderChars(s string) bool {
-  return strings.IndexFunc(s, func(r rune) bool {
-    return (r < 0x20 && r != '\t') || r == 0x7F || r >= 0x80
-  }) != -1
-}
+func containsInvalidHeaderChars(s string) bool {
+  for i := 0; i < len(s); i++ {
+    b := s[i]
+    if (b < 0x20 && b != '\t') || b == 0x7F || b >= 0x80 {
+      return true
+    }
+  }
+  return false
+}

middleware/basicauth/basicauth.go (4)

65-73: Minor: pick encoding once to avoid a second decode attempt.

You can choose RawStdEncoding upfront when no '=' padding is present to skip the initial failing decode.

Apply:

- raw, err := base64.StdEncoding.DecodeString(rest)
- if err != nil {
-   if _, ok := err.(base64.CorruptInputError); ok {
-     raw, err = base64.RawStdEncoding.DecodeString(rest)
-   }
-   if err != nil {
-     return cfg.BadRequest(c)
-   }
- }
+ enc := base64.StdEncoding
+ if !strings.ContainsRune(rest, '=') {
+   enc = base64.RawStdEncoding
+ }
+ raw, err := enc.DecodeString(rest)
+ if err != nil {
+   return cfg.BadRequest(c)
+ }

---

83-87: Optional: avoid UnsafeString to reduce secret lifetime coupling.

Using UnsafeString ties the password string to the mutable backing array. Prefer an explicit copy and wipe the byte slice afterward for a modest hardening, at the cost of one alloc.

- if c.App().Config().Immutable {
-   creds = string(raw)
- } else {
-   creds = utils.UnsafeString(raw)
- }
+ creds = string(raw) // copy
+ for i := range raw { // best-effort wipe
+   raw[i] = 0
+ }

If perf is critical, keep current behavior but add a short comment documenting the trade-off.

---

91-99: Use strings.Cut for first-colon split.

Improves clarity and avoids manual index handling.

- index := strings.Index(creds, ":")
- if index == -1 {
-   return cfg.BadRequest(c)
- }
- // Get the username and password
- username := creds[:index]
- password := creds[index+1:]
+ username, password, ok := strings.Cut(creds, ":")
+ if !ok {
+   return cfg.BadRequest(c)
+ }

---

100-103: Consider rejecting Unicode format controls (Cf) too.

You currently block Cc controls. Adding Cf (e.g., bidi markers, zero-width) reduces spoofing risk in credentials.

-func containsCTL(s string) bool {
-  return strings.IndexFunc(s, unicode.IsControl) != -1
-}
+func containsCTL(s string) bool {
+  return strings.IndexFunc(s, func(r rune) bool {
+    return unicode.IsControl(r) || unicode.Is(unicode.Cf, r)
+  }) != -1
+}

And keep the existing call sites.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

middleware/basicauth/basicauth.go (2)

114-116: Resolved prior suggestion: concise control-char check.

Using strings.IndexFunc with unicode.IsControl addresses earlier feedback to streamline this check.

---

118-122: Resolved prior suggestion: header-char validation extracted.

Encapsulating invalid header rune filtering into containsInvalidHeaderChars improves readability and reuse.

middleware/basicauth/basicauth.go (3)

55-62: Clarify and align whitespace policy after the scheme (exactly one space vs. multiple).

Code enforces exactly one space; tests mirror that, but PR objectives say “allow multiple spaces.” Please confirm intent. If multiple spaces should be allowed, consider:

-	rest := auth[len(basicScheme):]
-	if len(rest) < 2 || rest[0] != ' ' || rest[1] == ' ' {
-		return cfg.BadRequest(c)
-	}
-	rest = rest[1:]
-	if strings.IndexFunc(rest, unicode.IsSpace) != -1 {
-		return cfg.BadRequest(c)
-	}
+	rest := auth[len(basicScheme):]
+	orig := rest
+	rest = strings.TrimLeft(rest, " ")
+	if len(rest) == len(orig) || rest == "" { // require at least one space, then payload
+		return cfg.BadRequest(c)
+	}
+	// no whitespace inside token68
+	if strings.ContainsAny(rest, " \t") {
+		return cfg.BadRequest(c)
+	}

---

60-62: Nit: prefer ASCII check for payload whitespace.

Since non-ASCII was already rejected, unicode.IsSpace is heavier than needed. Use strings.ContainsAny(rest, " \t").

-	if strings.IndexFunc(rest, unicode.IsSpace) != -1 {
+	if strings.ContainsAny(rest, " \t") {
 		return cfg.BadRequest(c)
 	}

---

100-103: Consider whether to also reject Unicode “format” characters (Cf) in creds.

unicode.IsControl covers Cc; if you want to prevent invisible format characters (e.g., ZWJ) in usernames/passwords, extend the predicate.

-	if containsCTL(username) || containsCTL(password) {
+	if containsCTLOrFormat(username) || containsCTLOrFormat(password) {
 		return cfg.BadRequest(c)
 	}

Additional helper (outside this hunk):

func containsCTLOrFormat(s string) bool {
	return strings.IndexFunc(s, func(r rune) bool { return unicode.IsControl(r) || unicode.In(r, unicode.Format) }) != -1
}

middleware/basicauth/basicauth_test.go (2)

237-260: Augment whitespace table for coverage (leading multiples and case-insensitive scheme).

Add a few benign-accept cases to cement intent and guard regressions.

  cases := []struct {
  	header string
  	status int
  }{
  	{"Basic " + creds, fiber.StatusTeapot},
  	{" Basic " + creds, fiber.StatusTeapot},
+  {"   Basic " + creds, fiber.StatusTeapot},    // multiple leading spaces
+  {"\t  Basic " + creds, fiber.StatusTeapot},   // mixed leading ws
+  {"basic " + creds, fiber.StatusTeapot},       // scheme case-insensitive
  	{"Basic  " + creds, fiber.StatusBadRequest},
  	{"Basic   " + creds, fiber.StatusBadRequest},
  	{"Basic\t" + creds, fiber.StatusBadRequest},
  	{"Basic \t" + creds, fiber.StatusBadRequest},
  	{"Basic\u00A0" + creds, fiber.StatusBadRequest},
  	{"Basic\u3000" + creds, fiber.StatusBadRequest},
  	{"\tBasic " + creds + "\t", fiber.StatusTeapot},
  	{"Basic " + creds[:4] + " " + creds[4:], fiber.StatusBadRequest},
  }

---

405-433: Add exact-boundary case for HeaderLimit.

Minor: include a test where header length equals the limit to document inclusivity.

 t.Run("allowed", func(t *testing.T) {
   t.Parallel()
   app := fiber.New()
-  app.Use(New(Config{Users: map[string]string{"john": hashedJohn}, HeaderLimit: 100}))
+  // exact boundary
+  limit := len("Basic ") + len(creds)
+  app.Use(New(Config{Users: map[string]string{"john": hashedJohn}, HeaderLimit: limit}))
   app.Get("/", func(c fiber.Ctx) error { return c.SendStatus(fiber.StatusTeapot) })
   req := httptest.NewRequest(fiber.MethodGet, "/", nil)
   req.Header.Set(fiber.HeaderAuthorization, "Basic "+creds)
   resp, err := app.Test(req)
   require.NoError(t, err)
   require.Equal(t, fiber.StatusTeapot, resp.StatusCode)
 })

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/store.go:164-167
Timestamp: 2024-10-02T23:03:31.727Z
Learning: Unit tests in this project use testify require.

Learnt from: sixcolors
PR: gofiber/fiber#2922
File: middleware/cors/utils.go:63-71
Timestamp: 2024-10-08T19:06:06.583Z
Learning: The project uses the testify/assert package for assertions in unit tests.

Learnt from: ReneWerner87
PR: gofiber/fiber#3161
File: app.go:923-932
Timestamp: 2024-11-15T07:56:21.623Z
Learning: In the Fiber framework, breaking changes are acceptable when moving from version 2 to version 3, including modifications to method signatures such as in the `Test` method in `app.go`.

middleware/basicauth/basicauth_test.go (3)

227-261: Whitespace matrix is thorough; add 1 trailing-space case?

Optional: add {"Basic " + creds + " ", fiber.StatusTeapot} to cover right-trim behavior for a plain space (you already cover tabs).

---

262-290: Fix unused parameter in Authorizer (revive).

Rename p to _ to satisfy lint without changing behavior.

Apply this diff:

-    Authorizer: func(_, p string, _ fiber.Ctx) bool {
+    Authorizer: func(_, _ string, _ fiber.Ctx) bool {
       called = true
       return true
     },

---

325-345: Fix unused parameter in Authorizer (revive).

Same lint as above; rename p to _.

Apply this diff:

-    Authorizer: func(_, p string, _ fiber.Ctx) bool {
+    Authorizer: func(_, _ string, _ fiber.Ctx) bool {
       called = true
       return true
     },

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/store.go:164-167
Timestamp: 2024-10-08T19:06:06.583Z
Learning: Unit tests in this project use testify require.

Learnt from: sixcolors
PR: gofiber/fiber#2922
File: middleware/cors/utils.go:63-71
Timestamp: 2024-10-08T19:06:06.583Z
Learning: The project uses the testify/assert package for assertions in unit tests.

Learnt from: ReneWerner87
PR: gofiber/fiber#3161
File: app.go:923-932
Timestamp: 2024-11-15T07:56:21.623Z
Learning: In the Fiber framework, breaking changes are acceptable when moving from version 2 to version 3, including modifications to method signatures such as in the `Test` method in `app.go`.

middleware/basicauth/basicauth_test.go (7)

174-176: Also assert no WWW-Authenticate header on 400.

Strengthen the BadRequest contract.

Apply:

   require.NoError(t, err)
   require.Equal(t, fiber.StatusBadRequest, resp.StatusCode)
+  require.Empty(t, resp.Header.Get(fiber.HeaderWWWAuthenticate))

---

194-208: Add header absence check for malformed credentials.

Ensure 400 responses don’t include WWW-Authenticate.

Apply:

   require.NoError(t, err)
   require.Equal(t, fiber.StatusBadRequest, resp.StatusCode)
+  require.Empty(t, resp.Header.Get(fiber.HeaderWWWAuthenticate))

---

227-260: Name subcases for easier debugging; add trailing-whitespace cases.

Current table is good; subtests will pinpoint failures and a couple more cases close gaps.

Apply:

- for _, tt := range cases {
+ for i, tt := range cases {
+   t.Run(fmt.Sprintf("case_%d", i), func(t *testing.T) {
      req := httptest.NewRequest(fiber.MethodGet, "/", nil)
      req.Header.Set(fiber.HeaderAuthorization, tt.header)
      resp, err := app.Test(req)
      require.NoError(t, err)
      require.Equal(t, tt.status, resp.StatusCode)
- }
+   })
+ }

And extend the cases:

   cases := []struct {
     header string
     status int
   }{
     {"Basic " + creds, fiber.StatusTeapot},
     {" Basic " + creds, fiber.StatusTeapot},
+    {"Basic " + creds + " ", fiber.StatusTeapot},
+    {"Basic " + creds + "\t", fiber.StatusTeapot},
     {"Basic  " + creds, fiber.StatusBadRequest},

---

309-324: Non‑ASCII bytes in header should also assert no challenge.

Mirror the 400-no-header contract.

Apply:

 handler(fctx)
 require.Equal(t, fiber.StatusBadRequest, fctx.Response.StatusCode())
+require.Empty(t, string(fctx.Response.Header.Peek(fiber.HeaderWWWAuthenticate)))

---

325-345: Invalid UTF‑8 test: add absence of challenge header.

Small assertion to lock in behavior.

Apply:

 require.NoError(t, err)
 require.Equal(t, fiber.StatusBadRequest, resp.StatusCode)
 require.False(t, called)
+require.Empty(t, resp.Header.Get(fiber.HeaderWWWAuthenticate))

---

346-369: Normalization path looks right.

Optional: also assert UsernameFromContext(c) is the normalized form to exercise locals-setting.

If desired, change the route:

- app.Get("/", func(c fiber.Ctx) error { return c.SendStatus(fiber.StatusTeapot) })
+ app.Get("/", func(c fiber.Ctx) error { return c.SendString(UsernameFromContext(c)) })

And assert:

 require.NoError(t, err)
- require.Equal(t, fiber.StatusTeapot, resp.StatusCode)
+ require.Equal(t, fiber.StatusOK, resp.StatusCode)
+ body, _ := io.ReadAll(resp.Body)
+ require.Equal(t, "é", string(body))
 require.True(t, called)

---

371-395: Header CR/LF edges: also assert no challenge.

Keeps 400 semantics consistent.

Apply inside the loop:

 handler(fctx)
 require.Equal(t, fiber.StatusBadRequest, fctx.Response.StatusCode())
+require.Empty(t, string(fctx.Response.Header.Peek(fiber.HeaderWWWAuthenticate)))

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/store.go:164-167
Timestamp: 2024-10-08T19:06:06.583Z
Learning: Unit tests in this project use testify require.

Learnt from: sixcolors
PR: gofiber/fiber#2922
File: middleware/cors/utils.go:63-71
Timestamp: 2024-10-08T19:06:06.583Z
Learning: The project uses the testify/assert package for assertions in unit tests.

Learnt from: ReneWerner87
PR: gofiber/fiber#3161
File: app.go:923-932
Timestamp: 2024-11-15T07:56:21.623Z
Learning: In the Fiber framework, breaking changes are acceptable when moving from version 2 to version 3, including modifications to method signatures such as in the `Test` method in `app.go`.