lfnovo/open-notebook

Problem A password containing characters outside latin-1 can never authenticate over HTTP. The result is a permanent 401 with no way to succeed and no error explaining why. Pure-ASCII passwords are unaffected, which is why this has gone unnoticed. ASGI carries raw header bytes and Starlette decodes header values as latin-1, so the credential string reaching the middleware is the latin-1 decoding of whatever bytes the client sent. api/auth.py:71-73 then re-encodes that string as UTF-8 before comparing it against the UTF-8 bytes of the configured password: if not secrets.compare_digest( credentials.encode("utf-8"), self.password.encode("utf-8") ): For pässwörd-中文 a UTF-8 client sends bytes that decode to mojibake, and no value the client can send will match. Fix api/auth.py:71 — recover the wire bytes instead of re-encoding the mojibake: if not secrets.compare_digest( credentials.encode("latin-1"), self.password.encode("utf-8") ): Stay in bytes rather than round-tripping