diff --git a/CHANGELOG.md b/CHANGELOG.md index 4b5df46..889d553 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## 3.2.2 under development +- Bug #116: Fix authentication scheme in `HttpBearer` challenge according to RFC 6750 (@samdark) - Chg #104: Bump minimal PHP version to 8.1 (@vjik) - Enh #104: Explicitly mark readonly properties (@vjik) - Enh #105: Explicitly import classes and functions in "use" section (@mspirkov) diff --git a/src/Method/HttpBearer.php b/src/Method/HttpBearer.php index e3f1487..dac3909 100644 --- a/src/Method/HttpBearer.php +++ b/src/Method/HttpBearer.php @@ -25,7 +25,7 @@ final class HttpBearer extends HttpHeader public function challenge(ResponseInterface $response): ResponseInterface { - return $response->withHeader(Header::WWW_AUTHENTICATE, "{$this->headerName} realm=\"{$this->realm}\""); + return $response->withHeader(Header::WWW_AUTHENTICATE, "Bearer realm=\"{$this->realm}\""); } /** diff --git a/tests/Method/CompositeTest.php b/tests/Method/CompositeTest.php index 3047343..4234262 100644 --- a/tests/Method/CompositeTest.php +++ b/tests/Method/CompositeTest.php @@ -103,7 +103,7 @@ public function testChallengeIsCorrect(): void ])); $this->assertEquals( - 'Authorization realm="api"', + 'Bearer realm="api"', $authenticationMethod ->challenge($response) ->getHeaderLine(Header::WWW_AUTHENTICATE), diff --git a/tests/Method/HttpBearerTest.php b/tests/Method/HttpBearerTest.php index cbab9a8..9d7c202 100644 --- a/tests/Method/HttpBearerTest.php +++ b/tests/Method/HttpBearerTest.php @@ -56,7 +56,7 @@ public function testChallengeIsCorrect(): void $authenticationMethod = new HttpBearer($identityRepository); $this->assertEquals( - 'Authorization realm="api"', + 'Bearer realm="api"', $authenticationMethod ->challenge($response) ->getHeaderLine(Header::WWW_AUTHENTICATE), @@ -71,7 +71,7 @@ public function testCustomRealm(): void ->withRealm('gateway'); $this->assertEquals( - 'Authorization realm="gateway"', + 'Bearer realm="gateway"', $authenticationMethod ->challenge($response) ->getHeaderLine(Header::WWW_AUTHENTICATE),