Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Any space before and after Authorization header will result in the failure of koa-kwt to process and return an error #156

Closed
notbucai opened this issue Oct 4, 2019 · 3 comments

Comments

@notbucai
Copy link

notbucai commented Oct 4, 2019

Any space before and after Authorization header will result in the failure of koa-kwt to process and return an error

If it's not a standard header it will return Could not get any response

example

Authorization (There's a space here) : "Bearer xxxxxx"
return Could not get any response
not error

@notbucai
Copy link
Author

notbucai commented Oct 4, 2019

Unless also won't work

@sdd
Copy link
Collaborator

sdd commented May 17, 2020

As far a I can tell, According to the most recent RFC I can find for the HTTP spec (https://tools.ietf.org/html/rfc7230#page-83), spaces before the colon are not permitted:

header-field = field-name ":" OWS field-value OWS

As such, I don't think we should permit that.

But, optional whitespace is permitted after the colon and preceding Bearer (as well as after the token itself).

I've submitted this PR to handle whitespace that conforms to the spec.

@notbucai
Copy link
Author

As far a I can tell, According to the most recent RFC I can find for the HTTP spec (https://tools.ietf.org/html/rfc7230#page-83), spaces before the colon are not permitted:

header-field = field-name ":" OWS field-value OWS

As such, I don't think we should permit that.

But, optional whitespace is permitted after the colon and preceding Bearer (as well as after the token itself).

I've submitted this PR to handle whitespace that conforms to the spec.

thank you

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants