Skip to content

fix(token): fix bearer extraction case-sensitivity bug [H4]#552

Merged
lakhansamani merged 1 commit into
mainfrom
fix/h4-bearer-case-sensitivity
Apr 4, 2026
Merged

fix(token): fix bearer extraction case-sensitivity bug [H4]#552
lakhansamani merged 1 commit into
mainfrom
fix/h4-bearer-case-sensitivity

Conversation

@lakhansamani
Copy link
Copy Markdown
Contributor

@lakhansamani lakhansamani commented Apr 3, 2026

Summary

  • H4 (High): Bearer token extraction was case-sensitive despite case-insensitive validation
  • bearer token123 would return the full bearer token123 as the "token"
  • Now uses authSplit[1] instead of TrimPrefix("Bearer ")
  • Fixed in both GetAccessToken and GetIDToken

Test plan

  • Package compiles
  • Verify "Bearer tok", "bearer tok", "BEARER tok" all extract "tok"
@lakhansamani
fix(token): fix bearer token extraction case-sensitivity bug
d5fb082 
GetAccessToken and GetIDToken validated the scheme case-insensitively
but extracted the token with case-sensitive TrimPrefix("Bearer ").
Sending "bearer token123" would return "bearer token123" as the token.

Now uses authSplit[1] directly after the case-insensitive check.

Fixes: H4 (High)
@lakhansamani lakhansamani merged commit ec5d689 into main Apr 4, 2026
@lakhansamani lakhansamani deleted the fix/h4-bearer-case-sensitivity branch April 4, 2026 05:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant

@lakhansamani