Improve Auth Header Parsing

Related: #105

Use the URL safe version of base64 decoding. Don't break
when comparing secret keys to advert possible timing attacks.
Add tests for auth parsing.

auth/auth.go

@@ -19,6 +19,7 @@ var (
 	keys []*fernet.Key
 )
 
+
 func init() {
 	s := os.Getenv("SECRETS")
 	if len(s) > 0 {
@@ -50,7 +51,7 @@ func Parse(authLine string) (string, error) {
 		return "", errors.New("Authorization must be basic.")
 	}
 	payload := parts[1]
-	decodedPayload, err := base64.StdEncoding.DecodeString(payload)
+	decodedPayload, err := base64.URLEncoding.DecodeString(payload)
 	if err != nil {
 		return "", err
 	}
@@ -80,7 +81,6 @@ func ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	for i := range keys {
 		if user == keys[i].Encode() {
 			matched = true
-			break
 		}
 	}
 	if !matched {

auth/auth_test.go

@@ -58,3 +58,25 @@ func testEncryptDecrypt(t *testing.T, ts authTest) {
 		t.Fatalf("actual=%q expected=%q\n", actualOutput, ts.output)
 	}
 }
+
+var parseTests = []struct{
+	input string
+	output string
+}{
+	{
+		"Basic QmVjc3RzWVNrSlkzM1VzOTFrZ2w2cVB1Ykhvd1dYY3FhQnhxaHU3TnU2Xz06",
+		"BecstsYSkJY33Us91kgl6qPubHowWXcqaBxqhu7Nu6_=",
+	},
+}
+
+func TestParse(t *testing.T) {
+	for _, ts := range parseTests {
+		res, err := Parse(ts.input)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if res != ts.output {
+			t.Fatalf("acutal=%s expected=%s\n", res, ts.output)
+		}
+	}
+}