Repository navigation
fix(httpapi): match the Bearer auth scheme case-insensitively - #1754
Merged
Dumbris merged 1 commit intoOct 26, 2026
Merged
Conversation
Co-authored-by: Cursor <cursoragent@cursor.com>
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Dumbris
approved these changes
Oct 26, 2026
Dumbris
left a comment
Dumbris
left a comment
Member
There was a problem hiding this comment.
Verified: the PR test fails on main for the reason described and passes on this branch merged with main; race tests for the touched packages and CI lint (bare and server tags) are clean. Also built and tested together with the rest of this batch, independently reviewed, and cross-reviewed with a second model.
Dumbris
pushed a commit
that referenced
this pull request
Oct 26, 2026
…ser JWTs (#1755) ## Bug `ServerEditionAuthMiddleware.authenticateFromBearer` only recognises an `Authorization` header that starts with the exact bytes `Bearer `. The auth-scheme name is case-insensitive (RFC 7235 §2.1, RFC 6750 §2.1), so a valid user JWT sent as `bearer <jwt>` or `BEARER <jwt>` is ignored and the request gets `401 Authentication required` on the server edition. ## Trigger Build with `-tags server`, log in, mint a JWT with `POST /api/v1/auth/token`, then: ``` curl -H 'Authorization: bearer <jwt>' http://host/api/v1/servers # 401 curl -H 'Authorization: Bearer <jwt>' http://host/api/v1/servers # 200 ``` ## Fix Compare the scheme prefix with `strings.EqualFold` instead of `strings.HasPrefix`. Nothing else changes: empty tokens and agent tokens are still skipped, and the JWT is validated exactly as before. This is the server-edition counterpart of #1754 (which fixes the core `internal/httpapi` parser). The two are independent and can land in either order. ## Test `TestMiddleware_ValidJWT_SchemeCaseInsensitive` sends a valid JWT with the `bearer` and `BEARER` schemes through `Middleware()` and checks for 200 and the right `user_id`. ## Commands run - `CGO_ENABLED=0 go test -count=1 -tags server ./internal/serveredition/auth`: ok on 3 of 4 runs. The one failing run was `TestHandleCallback_Unavailable_ProviderErrorRenders503`, an OAuth-callback timing test that does not go through this middleware. It passes alone (`-count=3`) and passes on the other three full runs. - `CGO_ENABLED=0 go test -count=1 -tags server -skip TestHandleCallback_Unavailable_ProviderErrorRenders503 ./internal/serveredition/auth`: ok - `CGO_ENABLED=0 go vet -tags server ./internal/serveredition/auth`: clean - With the fix reverted (`git stash` of `middleware.go`), `-run SchemeCaseInsensitive` fails with `bearer: expected 200 ..., got 401` and `BEARER: expected 200 ..., got 401`. - `gofmt -l` on the edited files: no output Co-authored-by: Cursor <cursoragent@cursor.com>
Member
|
Merged. Thank you, @rudycelekli! The REST API accepts the Bearer scheme in any case, as RFC 7235/6750 require. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug
The REST auth middleware only recognises an
Authorizationheader that starts with the exact bytesBearer. The auth-scheme name is case-insensitive (RFC 7235 §2.1, RFC 6750 §2.1), so a client or proxy that sendsbearer <key>orBEARER <key>is rejected with401 Invalid or missing API keyeven though the key is valid. Because precedence is decided by header membership, the request never falls back to?apikey=or the session cookie either.Trigger
Fix
Add a small
bearerToken(header)helper ininternal/httpapithat compares the scheme withstrings.EqualFold, and use it at the three places that parse the header:authenticateBearer,ExtractToken, andsessionCredentialValue(SSE re-check of a bearer JWT). The last one has to match the first, otherwise a JWT accepted with a lowercase scheme would read back as empty during the/eventsscope check.Test
TestBearerScheme_CaseInsensitivesends the admin key withBearer,bearerandBEARERthroughExtractTokenand through the fullServeHTTPmiddleware, and checks thatBasicstill yields no token.Commands run
CGO_ENABLED=0 go test -count=1 ./internal/httpapi— okCGO_ENABLED=0 go vet ./internal/httpapi— cleangit stashofserver.goandsse_scope.go):go test -count=1 -run TestBearerScheme ./internal/httpapi— FAIL (thebearerandBEARERsubtests: token mismatch and 401)gofmt -lon the edited files — no output