Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Websocket proxy auth truncates passwords that contain a colon

Open Beginner friendly
  • Is something wrong?
#2,734 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@Akshaay1 is already working on this.

Since Oct 13, 2026.

  • #2738 by @Akshaay1 — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
86/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
backend

Research direction

Start in kubernetes/stream/ws_client.py at the credential split around line 602, then inspect nearby tests for websocket_proxycare. Reproduce with the provided snippet, including a password containing colons and malformed credentials. Done when the full password is preserved and malformed headers no longer raise an uncaught IndexError, with tests covering both cases.

Written by the indexing model from the issue text.

Description

help wanted

What happened (please include outputs or screenshots):

While testing an experimental version of Perch, we found the following and figured it was worth a report.

websocket_proxycare splits the decoded proxy-authorization credentials on every : and keeps only the first two parts. A proxy password that contains a colon is cut off, so websocket calls (stream for exec, attach and port-forward) through an authenticated proxy send the wrong password.

import base64
from types import SimpleNamespace
from kubernetes.stream.ws_client import websocket_proxycare

cred = base64.b64encode(b"alice:pa:ss:word").decode()
cfg = SimpleNamespace(no_proxy=None, proxy="http://proxy:3128",
                      proxy_headers={"proxy-authorization": "Basic " + cred})
print(websocket_proxycare({}, cfg, "wss://h", {})["http_proxy_auth"])
# ('alice', 'pa')

The same code raises IndexError: list index out of range when the header is just Basic, or when the decoded value has no colon.

What you expected to happen:

('alice', 'pa:ss:word'). RFC 7617 allows colons in the password; only the user-id can't contain one.

How to reproduce it (as minimally and precisely as possible):

Run the snippet above against master. No cluster is needed.

Anything else we need to know?:

The split is at kubernetes/stream/ws_client.py:602:

auth = urlsafe_b64decode(b64value).decode().split(':')
connect_opt.update({'http_proxy_auth': (auth[0], auth[1]) })

split(':', 1) would keep the full password.

Environment:

  • Kubernetes version (kubectl version): not needed, no cluster involved
  • OS (e.g., MacOS 10.13.6): macOS 26.2 (arm64)
  • Python version (python --version): 3.14.2
  • Python client version (pip list | grep kubernetes): 37.0.0+snapshot (master, bb9199f7)
Dominant language
Python
Stars
7.7k
Forks
3.5k
Avg merge
1d 13h
Merged PRs (30d)
19

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from kubernetes-client/python

All issues in kubernetes-client/python

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.