Blank page : ValueError: not enough values to unpack (expected 2, got 0)

[edgarogh]

Describe the bug

I'm trying to use flower with basic auth, and when going to the correct URL, I get a completely blank page (curl shows no output) with the following error being logged

Sep 11 15:00:26 my_hostname celery[2248943]: [E 220911 15:00:26 web:1221] Uncaught exception in write_error
Sep 11 15:00:26 my_hostname celery[2248943]:     Traceback (most recent call last):
Sep 11 15:00:26 my_hostname celery[2248943]:       File "/usr/local/lib/python3.8/dist-packages/tornado/web.py", line 1711, in _execute
Sep 11 15:00:26 my_hostname celery[2248943]:         result = method(*self.path_args, **self.path_kwargs)
Sep 11 15:00:26 my_hostname celery[2248943]:       File "/usr/local/lib/python3.8/dist-packages/flower/views/error.py", line 8, in get
Sep 11 15:00:26 my_hostname celery[2248943]:         raise tornado.web.HTTPError(404)
Sep 11 15:00:26 my_hostname celery[2248943]:     tornado.web.HTTPError: HTTP 404: Not Found
Sep 11 15:00:26 my_hostname celery[2248943]:     
Sep 11 15:00:26 my_hostname celery[2248943]:     During handling of the above exception, another exception occurred:
Sep 11 15:00:26 my_hostname celery[2248943]:     
Sep 11 15:00:26 my_hostname celery[2248943]:     Traceback (most recent call last):
Sep 11 15:00:26 my_hostname celery[2248943]:       File "/usr/local/lib/python3.8/dist-packages/flower/views/__init__.py", line 73, in get_current_user
Sep 11 15:00:26 my_hostname celery[2248943]:         basic, credentials = auth_header.split()
Sep 11 15:00:26 my_hostname celery[2248943]:     ValueError: not enough values to unpack (expected 2, got 0)
Sep 11 15:00:26 my_hostname celery[2248943]:     
Sep 11 15:00:26 my_hostname celery[2248943]:     During handling of the above exception, another exception occurred:
Sep 11 15:00:26 my_hostname celery[2248943]:     
Sep 11 15:00:26 my_hostname celery[2248943]:     Traceback (most recent call last):
Sep 11 15:00:26 my_hostname celery[2248943]:       File "/usr/local/lib/python3.8/dist-packages/tornado/web.py", line 1219, in send_error
Sep 11 15:00:26 my_hostname celery[2248943]:         self.write_error(status_code, **kwargs)
Sep 11 15:00:26 my_hostname celery[2248943]:       File "/usr/local/lib/python3.8/dist-packages/flower/views/__init__.py", line 43, in write_error
Sep 11 15:00:26 my_hostname celery[2248943]:         self.render('404.html', message=message)
Sep 11 15:00:26 my_hostname celery[2248943]:       File "/usr/local/lib/python3.8/dist-packages/flower/views/__init__.py", line 36, in render
Sep 11 15:00:26 my_hostname celery[2248943]:         super(BaseHandler, self).render(*args, **kwargs)
Sep 11 15:00:26 my_hostname celery[2248943]:       File "/usr/local/lib/python3.8/dist-packages/tornado/web.py", line 865, in render
Sep 11 15:00:26 my_hostname celery[2248943]:         html = self.render_string(template_name, **kwargs)
Sep 11 15:00:26 my_hostname celery[2248943]:       File "/usr/local/lib/python3.8/dist-packages/tornado/web.py", line 1012, in render_string
Sep 11 15:00:26 my_hostname celery[2248943]:         namespace = self.get_template_namespace()
Sep 11 15:00:26 my_hostname celery[2248943]:       File "/usr/local/lib/python3.8/dist-packages/tornado/web.py", line 1028, in get_template_namespace
Sep 11 15:00:26 my_hostname celery[2248943]:         current_user=self.current_user,
Sep 11 15:00:26 my_hostname celery[2248943]:       File "/usr/local/lib/python3.8/dist-packages/tornado/web.py", line 1345, in current_user
Sep 11 15:00:26 my_hostname celery[2248943]:         self._current_user = self.get_current_user()
Sep 11 15:00:26 my_hostname celery[2248943]:       File "/usr/local/lib/python3.8/dist-packages/flower/views/__init__.py", line 78, in get_current_user
Sep 11 15:00:26 my_hostname celery[2248943]:         raise tornado.web.HTTPError(401)
Sep 11 15:00:26 my_hostname celery[2248943]:     tornado.web.HTTPError: HTTP 401: Unauthorized

It looks like the HTTP auth header is missing and the server doesn't check and tries an impossible tuple assignment.

To Reproduce

I just have to start a flower server with basic auth and curl localhost:5555/<base-path> to get this error. Flower is started on a path different than /.

But it's a bit suspicious that this hasn't been detected during debugging / code review. I don't really know what other information could be relevant. However, according to the exception, a header check is clearly missing somewhere anyways (and could give more information by catching the problem sooner or handling the request differently).

System information

flower   -> flower:1.2.0 tornado:6.2 humanize:4.3.0
software -> celery:5.2.7 (dawn-chorus) kombu:5.2.4 py:3.8.10
            billiard:3.6.4.0 py-amqp:5.1.1
platform -> system:Linux arch:64bit, ELF
            kernel version:5.4.0-96-generic imp:CPython
loader   -> celery.loaders.app.AppLoader
settings -> transport:amqp results:disabled

deprecated_settings: None