node: RFC 7235 mandates case-insensitive auth-schema mathcing

This commit is contained in:
Weixie Cui 2026-05-21 20:00:00 +08:00
parent efe58eac00
commit 0b47962017

View file

@ -47,7 +47,7 @@ func (handler *jwtHandler) ServeHTTP(out http.ResponseWriter, r *http.Request) {
strToken string strToken string
claims jwt.RegisteredClaims claims jwt.RegisteredClaims
) )
if auth := r.Header.Get("Authorization"); strings.HasPrefix(auth, "Bearer ") { if auth := r.Header.Get("Authorization"); len(auth) >= 7 && strings.EqualFold(auth[:7], "bearer ") {
strToken = strings.TrimPrefix(auth, "Bearer ") strToken = strings.TrimPrefix(auth, "Bearer ")
} }
if len(strToken) == 0 { if len(strToken) == 0 {