Merge pull request #372 from jonaspm/fix/broader-bearer-token-resolution

fix: Match Bearer case-insensitively and trim whitespace(s)

app/__test__/api/Api.spec.ts

@@ -70,4 +70,10 @@ describe("Api", async () => {
       expect(params.token_transport).toBe("header");
       expect(params.host).toBe("http://another.com");
    });
+
+   it("should extract tokens case insensitive", async () => {
+      const token = await sign({ sub: "test" }, "1234");
+      expect(new Api({ headers: new Headers({ Authorization: `Bearer ${token}` }) }).getAuthState().token).toBe(token);
+      expect(new Api({ headers: new Headers({ Authorization: `bearer ${token}` }) }).getAuthState().token).toBe(token);
+   })
 });

app/__test__/auth/Authenticator.spec.ts

@@ -38,4 +38,27 @@ describe("Authenticator", async () => {
       expect(cookie).toStartWith("auth=");
       expect(cookie).toEndWith("HttpOnly; Secure; SameSite=Strict");
    });
+
+   test("bearer token is case insensitive", async () => {
+      const auth = new Authenticator({}, null as any, {
+         jwt: {
+            secret: "secret",
+            fields: ["sub"],
+         },
+         cookie: {
+            sameSite: "strict",
+         },
+      });
+      const token = await auth.jwt({ sub: "test" });
+
+      const res = await auth.resolveAuthFromRequest(new Headers({
+         Authorization: `Bearer ${token}`,
+      }));
+      expect((res as any).sub).toBe("test")
+
+      const res2 = await auth.resolveAuthFromRequest(new Headers({
+         Authorization: `bearer ${token}`,
+      }));
+      expect((res2 as any).sub).toBe("test")
+   })
 });

app/src/Api.ts

@@ -121,7 +121,7 @@ export class Api {
          }
 
          // try authorization header
-         const headerToken = this.options.headers.get("authorization")?.replace("Bearer ", "");
+         const headerToken = this.options.headers.get("authorization")?.replace(/^Bearer\s+/i, "");
          if (headerToken) {
             this.token_transport = "header";
             this.updateToken(headerToken);

app/src/auth/authenticate/Authenticator.ts

@@ -430,7 +430,7 @@ export class Authenticator<
       let token: string | undefined;
       if (headers.has("Authorization")) {
          const bearerHeader = String(headers.get("Authorization"));
-         token = bearerHeader.replace("Bearer ", "");
+         token = bearerHeader.replace(/^Bearer\s+/i, "");
       } else {
          const context = is_context ? (c as Context) : ({ req: { raw: { headers } } } as Context);
          token = await this.getAuthCookie(context);