forks/go-ethereum
1
0
Fork 1
mirror of https://github.com/ethereum/go-ethereum.git synced 2026-07-19 03:10:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge fb0bcbc4b7 into 06b23b4293

Browse source
This commit is contained in:
0xoasis 2026-07-18 00:13:45 +08:00 committed by GitHub
commit 8f0e3bae75
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 13 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
node/jwt_handler.go
View file

@ -47,8 +47,10 @@ func (handler *jwtHandler) ServeHTTP(out http.ResponseWriter, r *http.Request) {
strToken string strToken string
claims jwt.RegisteredClaims claims jwt.RegisteredClaims
) )
// RFC 7235: authentication schemes are case-insensitive. Match with EqualFold
// and slice off the scheme prefix (do not use TrimPrefix, which is case-sensitive).
if auth := r.Header.Get("Authorization"); len(auth) >= 7 && strings.EqualFold(auth[:7], "bearer ") { if auth := r.Header.Get("Authorization"); len(auth) >= 7 && strings.EqualFold(auth[:7], "bearer ") {
strToken = strings.TrimPrefix(auth, "Bearer ") strToken = auth[7:]
} }
if len(strToken) == 0 { if len(strToken) == 0 {
http.Error(out, "missing token", http.StatusUnauthorized) http.Error(out, "missing token", http.StatusUnauthorized)

13
node/rpcstack_test.go
View file

@ -371,6 +371,16 @@ func TestJWT(t *testing.T) {
"bar": "baz", "bar": "baz",
})) }))
}, },
// RFC 7235: authentication scheme is case-insensitive.
func() string {
return fmt.Sprintf("bearer %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix()}))
},
func() string {
return fmt.Sprintf("BEARER %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix()}))
},
func() string {
return fmt.Sprintf("bEaReR %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix()}))
},
} }
for i, tokenFn := range expOk { for i, tokenFn := range expOk {
token := tokenFn() token := tokenFn()
@ -421,9 +431,6 @@ func TestJWT(t *testing.T) {
func() string { func() string {
return fmt.Sprintf("Bearer %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix()})) return fmt.Sprintf("Bearer %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix()}))
}, },
func() string {
return fmt.Sprintf("bearer %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix()}))
},
func() string { func() string {
return fmt.Sprintf("Bearer: %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix()})) return fmt.Sprintf("Bearer: %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix()}))
}, },