[ws-cczj]

BasicAuth, BasicAuthForRealm, and BasicAuthForProxy currently compare the entire authorization header case-sensitively. Correct credentials with basic, BASIC, or bAsIc therefore receive 401/407. RFC 9110 section 11.1 specifies that authentication scheme names are case-insensitive; Go's net/http.Request.BasicAuth accepts these variants as well.

Match the fixed-length Basic prefix case-insensitively, then compare the encoded credentials with the existing subtle.ConstantTimeCompare. Credentials remain case-sensitive. No API or dependencies are added.

The regression test exercises origin and proxy authentication with 30 subcases, including valid scheme variants, malformed headers, other schemes, a non-ASCII lookalike, and changes to encoded credentials, username, or password case. It checks response bodies, authenticated user values, and 401/407 challenges. Exactly six valid cases fail before the fix; all 30 pass afterward. An independent HTTP service reproduces the issue on tagged v1.12.0 and current master (0f09c3a) and succeeds with this fix.

Validation on Windows/amd64 with Go 1.26.2:

• Authentication tests, including the go_json variant, and go vet ./...: passed.
• Default, nomsgpack, and race package suites: passed with four existing Windows platform test failures excluded. An unfiltered run fails on exactly the same four tests on unchanged master: TestSaveUploadedFileWithPermission, TestSaveUploadedFileWithPermissionFailed, TestSaveUploadedFileToExistingDir, and TestFileDescriptor. No skips or workflow changes are included in this PR.
• golangci-lint v2.11.0 with --new-from-rev upstream/master: 0 issues. auth.go has 100% statement coverage in the default local package suite.
• The full Windows go_json suite panics in the go-json dependency during binding.TestMappingStructField; the same isolated test panics on unchanged master.

Current-commit CI: all 20 Linux/macOS combinations of Go 1.26/1.27 and default, nomsgpack, Sonic, go_json, and race passed, along with lint, CodeQL, and Codecov. Run Tests.

Known baseline: Trivy reports five vulnerabilities in unchanged golang.org/x/net v0.57.0. The official master scan reports the same five findings. Dependency updates are outside this focused fix.

Pull Request Checklist

• Open your pull request against the master branch.
• All tests pass in available continuous integration systems (e.g., GitHub Actions).
• Tests are added or modified as needed to cover code changes.
• If the pull request introduces a new feature, the feature is documented in the docs/doc.md. (Not applicable: bug fix.)

One commit, changing only auth.go and auth_test.go. The CI checkbox remains unchecked because the baseline Trivy security findings remain unresolved.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.71%. Comparing base (0f09c3a) to head (cc92cd4).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4912      +/-   ##
==========================================
+ Coverage   98.65%   98.71%   +0.06%     
==========================================
  Files          48       48              
  Lines        3188     3190       +2     
==========================================
+ Hits         3145     3149       +4     
+ Misses         43       41       -2     

Flag	Coverage Δ
--ldflags="-checklinkname=0" -tags sonic	98.64% <100.00%> (+<0.01%)	⬆️
-tags go_json	98.57% <100.00%> (+<0.01%)	⬆️
-tags nomsgpack	98.69% <100.00%> (+0.06%)	⬆️
go-1.26	98.33% <100.00%> (+<0.01%)	⬆️
go-1.27	98.75% <100.00%> (+0.07%)	⬆️
macos-latest	98.71% <100.00%> (+0.06%)	⬆️
ubuntu-latest	98.65% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.