Skip to content

Safely split incoming request headers, remove support for token presence in request body #39427

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jacobshandling merged 8 commits into from
Feb 18, 2026
Merged

Safely split incoming request headers, remove support for token presence in request body #39427

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
9405579
safely split incoming request headers
jacobshandling Feb 5, 2026
c47d0a3
check for not okay
jacobshandling Feb 5, 2026
1a10553
test extra header parts
jacobshandling Feb 5, 2026
af3c37e
remove suport for parsing token from request body, polish logic
jacobshandling Feb 11, 2026
f4583e3
typo fix
jacobshandling Feb 11, 2026
5cf1c1a
tune
jacobshandling Feb 13, 2026
f38f71d
tune
jacobshandling Feb 13, 2026
a5c99c5
fix typos
jacobshandling Feb 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 32 additions & 13 deletions server/contexts/token/token.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,27 +10,25 @@ import (

type key int

const tokenKey key = 0
const (
tokenKey key = 0
tokenDelimiter = " "
)

// Token is the concrete type that represents Fleet session tokens
type Token string

// FromHTTPRequest extracts an Authorization
// from an HTTP request if present.
func FromHTTPRequest(r *http.Request) Token {
headers := r.Header.Get("Authorization")
headerParts := strings.Split(headers, " ")
if len(headerParts) > 0 && strings.ToUpper(headerParts[0]) == "BEARER" {
if len(headerParts) == 2 {
return Token(headerParts[1])
}
// This indicates "no token". We don't want to read the request-body here.
return ""
}
if err := r.ParseForm(); err != nil {
return ""
authHeader := r.Header.Get("Authorization")
headerCouple, ok := parseHeaderLimited(authHeader)
if ok && strings.ToUpper(headerCouple[0]) == "BEARER" {
// If the Authorization header is present and properly formatted, return the token.
// Preserve case-insensitivity for "Bearer" prefix while case-sensitivity for the token value
return Token(headerCouple[1])
}
return Token(r.FormValue("token"))
return ""
}

// NewContext returns a new context carrying the Authorization Bearer token.
Expand All @@ -46,3 +44,24 @@ func FromContext(ctx context.Context) (Token, bool) {
token, ok := ctx.Value(tokenKey).(Token)
return token, ok
}

// parseHeaderLimited splits an authHeader into exactly two parts or nil, and returns an ok boolean indicating whether the passed in authHeader did have exactly 2 parts. If it did not, nil and false are returned.
func parseHeaderLimited(authHeader string) ([]string, bool) {
parts := make([]string, 2)

pre, remain, foundDelimiter := strings.Cut(authHeader, tokenDelimiter)
if !foundDelimiter {
return nil, false
}
parts[0] = pre
// Ensure the token value is the last part of the string and there are no more
// delimiters. This avoids an issue where malicious input could contain additional delimiters
// causing unnecessary overhead parsing tokens.
post, _, unexpectedDelimiterFound := strings.Cut(remain, tokenDelimiter)
if unexpectedDelimiterFound {
// more than 2 parts
return nil, false
}
parts[1] = post
return parts, true
}
35 changes: 34 additions & 1 deletion server/contexts/token/token_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,40 @@ func TestFromHTTPRequest(t *testing.T) {
Method: http.MethodPost,
Body: io.NopCloser(strings.NewReader("token=bar")),
},
want: "bar",
want: "", // no longer support parsing token from request body
}, {
name: "BEARER with 3 parts",
r: &http.Request{
Header: map[string][]string{
"Authorization": {"BEARER foobar extra"},
"Content-Type": {"application/x-www-form-urlencoded"},
},
Method: http.MethodPost,
Body: io.NopCloser(strings.NewReader("token=bar")),
},
want: "",
}, {
name: "BEARER with multiple extra parts",
r: &http.Request{
Header: map[string][]string{
"Authorization": {"BEARER foobar extra parts here"},
"Content-Type": {"application/x-www-form-urlencoded"},
},
Method: http.MethodPost,
Body: io.NopCloser(strings.NewReader("token=bar")),
},
want: "",
}, {
name: "bearer lowercase with extra parts",
r: &http.Request{
Header: map[string][]string{
"Authorization": {"bearer foobar extra"},
"Content-Type": {"application/x-www-form-urlencoded"},
},
Method: http.MethodPost,
Body: io.NopCloser(strings.NewReader("token=bar")),
},
want: "",
},
}
for _, tt := range tests {
Expand Down
Loading