diff --git a/tornado_http_auth.py b/tornado_http_auth.py
index 2c6efbb..cbe74c8 100644
--- a/tornado_http_auth.py
+++ b/tornado_http_auth.py
@@ -209,8 +209,11 @@ class BasicAuthMixin(object):
             raise self.SendChallenge()
 
         auth_data = auth_header.split(None, 1)[-1]
-        auth_data = base64.b64decode(auth_data).decode('ascii')
-        username, password = auth_data.split(':', 1)
+        try:
+            auth_data = base64.b64decode(auth_data, validate=True).decode('ascii')
+            username, password = auth_data.split(':', 1)
+        except (UnicodeDecodeError, binascii.Error):
+            raise self.SendChallenge()
 
         challenge = check_credentials_func(username)
         if not challenge:

authenticate_user method raises binascii.Error when provided auth is not base64
`authenticate_user` method raises uncontrolled exception when the provided Authorization header is not base64. To reproduce the issue:

```
curl -i \
    -H 'Accept:application/json' \
    -H 'Authorization:Basic not_a_base64_string' \
    http://localhost:8000/protected
```


diff --git a/tests/test_functional.py b/tests/test_functional.py
index d03680b..ca2a817 100644
--- a/tests/test_functional.py
+++ b/tests/test_functional.py
@@ -40,9 +40,14 @@ class AuthTest(AsyncHTTPTestCase):
         res = self.fetch('/basic')
         self.assertEqual(res.code, 401)
 
+        res = self.fetch('/basic', headers={'Authorization': 'Basic foo bar'})
+        self.assertEqual(res.code, 401)
+
         auth = '%s:%s' % ('user1', 'pass1')
         auth = b64encode(auth.encode('ascii'))
-        hdr = {'Authorization': 'Basic %s' % auth.decode('utf8')}
-        res = self.fetch('/basic', headers=hdr)
-        self.assertEqual(res.code, 200)
 
+        res = self.fetch('/basic', headers={'Authorization': 'Basic ___%s' % auth.decode('utf8')})
+        self.assertEqual(res.code, 401)
+
+        res = self.fetch('/basic', headers={'Authorization': 'Basic %s' % auth.decode('utf8')})
+        self.assertEqual(res.code, 200)

pip install -e .
parse_log_pytest
pytest
apt-get update apt-get install -y gcc
3.9
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
exceptiongroup==1.2.2
iniconfig==2.1.0
packaging==24.2
pluggy==1.5.0
pytest==8.3.5
tomli==2.2.1
tornado==6.4.2
-e git+https://github.com/gvalkov/tornado-http-auth.git@9eb225c1740fad1e53320b55d8d4fc6ab4ba58b6#egg=tornado_http_auth

name: tornado-http-auth
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=3.0.16=h5eee18b_0
  - pip=25.0=py39h06a4308_0
  - python=3.9.21=he870216_1
  - readline=8.2=h5eee18b_0
  - setuptools=75.8.0=py39h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - tzdata=2025a=h04d1e81_0
  - wheel=0.45.1=py39h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - exceptiongroup==1.2.2
      - iniconfig==2.1.0
      - packaging==24.2
      - pluggy==1.5.0
      - pytest==8.3.5
      - tomli==2.2.1
      - tornado==6.4.2
prefix: /opt/conda/envs/tornado-http-auth

tests/test_functional.py::AuthTest::test_basic_auth
tests/test_functional.py::AuthTest::test_digest_auth
tornado_http_auth.py
tornado_http_auth.py