Additionally allow "bearer" instead of only "Bearer" in Authorization… (#1558)

CHANGELOG.md

@@ -10,6 +10,7 @@ This project adheres to [Semantic Versioning](http://semver.org/).
  - #1525, Allow http status override through response.status guc - @steve-chavez
  - #1512, Allow schema cache reloading with NOTIFY - @steve-chavez
  - #1119, Allow config file reloading with SIGUSR2 - @steve-chavez
+ - #1558, Allow 'Bearer' with and without capitalization as authentication schema - @wolfgangwalther
 
 ### Fixed
 

src/PostgREST/ApiRequest.hs

@@ -263,6 +263,7 @@ userApiRequest confSchemas rootSpec req reqBody
   auth = fromMaybe "" $ lookupHeader hAuthorization
   tokenStr = case T.split (== ' ') (toS auth) of
     ("Bearer" : t : _) -> t
+    ("bearer" : t : _) -> t
     _                  -> ""
   endingIn:: [Text] -> Text -> Bool
   endingIn xx key = lastWord `elem` xx

test/Feature/AuthSpec.hs

@@ -170,3 +170,10 @@ spec actualPgVersion = describe "authorization" $ do
           { matchStatus = 400
           , matchHeaders = []
           }
+
+  it "allows 'Bearer' and 'bearer' as authentication schemes" $ do
+    let token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoicG9zdGdyZXN0X3Rlc3RfYXV0aG9yIiwiaWQiOiJqZG9lIn0.B-lReuGNDwAlU1GOC476MlO0vAt9JNoHIlxg2vwMaO0"
+    request methodGet "/authors_only" [authHeader "Bearer" token] ""
+      `shouldRespondWith` 200
+    request methodGet "/authors_only" [authHeader "bearer" token] ""
+      `shouldRespondWith` 200

test/SpecHelper.hs

@@ -190,15 +190,18 @@ noBlankHeader = notElem mempty
 noProfileHeader :: [Header] -> Bool
 noProfileHeader headers = isNothing $ find ((== "Content-Profile") . fst) headers
 
+authHeader :: BS.ByteString -> BS.ByteString -> Header
+authHeader typ creds =
+  (hAuthorization, typ <> " " <> creds)
+
 authHeaderBasic :: BS.ByteString -> BS.ByteString -> Header
 authHeaderBasic u p =
-  (hAuthorization, "Basic " <> (toS . B64.encode . toS $ u <> ":" <> p))
+  authHeader "Basic" $ toS . B64.encode . toS $ u <> ":" <> p
 
 authHeaderJWT :: BS.ByteString -> Header
-authHeaderJWT token =
+authHeaderJWT = authHeader "Bearer"
-  (hAuthorization, "Bearer " <> token)
 
--- | Tests whether the text can be parsed as a json object comtaining
+-- | Tests whether the text can be parsed as a json object containing
 -- the key "message", and optional keys "details", "hint", "code",
 -- and no extraneous keys
 isErrorFormat :: BL.ByteString -> Bool