Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by jcranmer on Monday December 16, 2019 @09:10PM (#21809806)

Practically speaking, you have to treat email addresses as case-preserving: you match case-insensitive, but you always store the case the user entered in directly.

I usually give my email address as starting with a capital letter for historical reasons, and I once had an issue that wouldn't let me log on with any case whatsoever, probably because it lowercased the email address and tried to match it against the uppercase in the database.

[ Parent | on HN ]

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by Alex3917 on Monday December 16, 2019 @09:27PM (#21809929)

> you match case-insensitive, but you always store the case the user entered in directly.

You still need to normalize the unicode for either search or display, unless you're only allowing ascii or something.

E.g. for the column you store for search and to guarantee uniqueness, casefold and then normalize to NFKC. And for the column you store for display, normalize to NFC. (And obviously you need to sanitize user input before doing anything.)

[ Parent | on HN ]