From 7f85b60fd0b8c1f2247766d89ea06754df970185 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Wed, 9 Sep 2026 21:16:20 +0000
Subject: [PATCH] =?UTF-8?q?API=20=ED=82=A4=20=EB=B9=84=EA=B5=90=20?=
 =?UTF-8?q?=EC=A4=91=20=EB=B0=9C=EC=83=9D=ED=95=98=EB=8A=94=20TypeError=20?=
 =?UTF-8?q?(DoS=20=EC=B7=A8=EC=95=BD=EC=A0=90)=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 saas_web.py            |  2 +-
 tests/test_saas_web.py | 23 +++++++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/saas_web.py b/saas_web.py
index 63265e94..5b280f05 100644
--- a/saas_web.py
+++ b/saas_web.py
@@ -114,7 +114,7 @@ async def require_api_key(request: Request, call_next):
     if configured_keys and not (request.method == "GET" and request.url.path == "/"):
         provided_key = request.headers.get("x-api-key", "")
         if not any(
-            hmac.compare_digest(provided_key, key) for key in configured_keys
+            hmac.compare_digest(provided_key.encode('utf-8'), key.encode('utf-8')) for key in configured_keys
         ):
             return JSONResponse(
                 status_code=401,
diff --git a/tests/test_saas_web.py b/tests/test_saas_web.py
index 3b57e033..a2d50896 100644
--- a/tests/test_saas_web.py
+++ b/tests/test_saas_web.py
@@ -780,6 +780,29 @@ def test_only_empty_entries_leave_endpoints_open(self):
             {"error": "Invalid target_bytes value. Must be greater than 0."},
         )
 
+    def test_non_ascii_header_does_not_crash(self):
+        import json
+        import asyncio
+        from fastapi import Request
+
+        with patch.dict(os.environ, {"CODEC_CARVER_API_KEYS": "secret-key"}):
+            scope = {
+                "type": "http",
+                "method": "POST",
+                "path": "/shrink",
+                "headers": [(b"x-api-key", "wrong-key-😊".encode("utf-8"))]
+            }
+            request = Request(scope)
+
+            async def dummy_call_next(req):
+                pass
+
+            response = asyncio.run(saas_web.require_api_key(request, dummy_call_next))
+
+            self.assertEqual(response.status_code, 401)
+            body = json.loads(response.body)
+            self.assertEqual(body, {"error": "Invalid or missing API key"})
+
     def test_get_configured_api_keys_parsing(self):
         with patch.dict(os.environ, {"CODEC_CARVER_API_KEYS": " a ,, b ,"}):
             self.assertEqual(saas_web.get_configured_api_keys(), ["a", "b"])