forks/go-ethereum
1
0
Fork 1
mirror of https://github.com/ethereum/go-ethereum.git synced 2026-07-19 11:20:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

node: strip bearer prefix case-insensitively

Browse source 
#35022 matched the Authorization scheme case-insensitively via
EqualFold, but still used case-sensitive TrimPrefix("Bearer "), so
tokens with "bearer"/"BEARER" never stripped the scheme and failed
JWT parsing. Slice off the prefix after the match instead, and cover
alternate casings in TestJWT.
This commit is contained in:
0xoasis 2026-07-18 00:12:51 +08:00
parent 06b23b4293
commit fb0bcbc4b7
2 changed files with 13 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
node/jwt_handler.go
View file

@ -47,8 +47,10 @@ func (handler *jwtHandler) ServeHTTP(out http.ResponseWriter, r *http.Request) {
strToken string
claims jwt.RegisteredClaims
)
// RFC 7235: authentication schemes are case-insensitive. Match with EqualFold
// and slice off the scheme prefix (do not use TrimPrefix, which is case-sensitive).
if auth := r.Header.Get("Authorization"); len(auth) >= 7 && strings.EqualFold(auth[:7], "bearer ") {
strToken = strings.TrimPrefix(auth, "Bearer ")
strToken = auth[7:]
}
if len(strToken) == 0 {
http.Error(out, "missing token", http.StatusUnauthorized)

13
node/rpcstack_test.go
View file

@ -371,6 +371,16 @@ func TestJWT(t *testing.T) {
"bar": "baz",
}))
},
// RFC 7235: authentication scheme is case-insensitive.
func() string {
return fmt.Sprintf("bearer %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix()}))
},
func() string {
return fmt.Sprintf("BEARER %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix()}))
},
func() string {
return fmt.Sprintf("bEaReR %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix()}))
},
}
for i, tokenFn := range expOk {
token := tokenFn()
@ -421,9 +431,6 @@ func TestJWT(t *testing.T) {
func() string {
return fmt.Sprintf("Bearer %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix()}))
},
func() string {
return fmt.Sprintf("bearer %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix()}))
},
func() string {
return fmt.Sprintf("Bearer: %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix()}))
},