Static tokens are not case sensitive

[pzehle]

I have no idea if this is the right repo for this issue. I have a static token, I put it in the user in the database as explained in the docs, then when attempting to use it as Authorization: Bearer token, it does not check if the token is case sensitive or not. To reproduce, just use any token you want, and change a capital A for a small a, the check will pass and consider the token is correct.

Don't know if this is the right behavior, but I just wanted to point it out.

Latest version, Ubuntu.

Thanks!

[rijkvanzanten]

Not sure if this was designed like this, but it feels like a bug to me. I personally think the token should be case sensitive. What do you think @pzehle ?

[pzehle]

@rijkvanzanten I totally agree. I feel this like a bug, because you lower the security of a token to probably half when it is not case sensitive. If this is planned then I would think this is not a good behavior.