From 63f2b6094f59cc9ded6a83ac3def4a1726890a8b Mon Sep 17 00:00:00 2001 From: Nicolas Le Bas Date: Wed, 28 Nov 2018 17:31:49 -0500 Subject: [PATCH] The "Bearer" keyword should be case-insensitive The Authorization header was matched for OAuth2 against the "Bearer" keyword in a case sensitive fashion. According to RFC 2617, it should be case insensitive and some oauth clients (including some earlier versions of spring-security) expect it so. --- .../server/resource/web/DefaultBearerTokenResolver.java | 6 ++++-- .../resource/web/DefaultBearerTokenResolverTests.java | 8 ++++++++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolver.java b/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolver.java index c4532fa029..e8d97ca234 100644 --- a/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolver.java +++ b/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolver.java @@ -36,7 +36,9 @@ import org.springframework.util.StringUtils; */ public final class DefaultBearerTokenResolver implements BearerTokenResolver { - private static final Pattern authorizationPattern = Pattern.compile("^Bearer (?[a-zA-Z0-9-._~+/]+)=*$"); + private static final Pattern authorizationPattern = Pattern.compile( + "^Bearer (?[a-zA-Z0-9-._~+/]+)=*$", + Pattern.CASE_INSENSITIVE); private boolean allowFormEncodedBodyParameter = false; @@ -87,7 +89,7 @@ public final class DefaultBearerTokenResolver implements BearerTokenResolver { private static String resolveFromAuthorizationHeader(HttpServletRequest request) { String authorization = request.getHeader(HttpHeaders.AUTHORIZATION); - if (StringUtils.hasText(authorization) && authorization.startsWith("Bearer")) { + if (StringUtils.startsWithIgnoreCase(authorization, "bearer")) { Matcher matcher = authorizationPattern.matcher(authorization); if (!matcher.matches()) { diff --git a/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolverTests.java b/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolverTests.java index 32518f4d1a..4286b63671 100644 --- a/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolverTests.java +++ b/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolverTests.java @@ -51,6 +51,14 @@ public class DefaultBearerTokenResolverTests { assertThat(this.resolver.resolve(request)).isEqualTo(TEST_TOKEN); } + @Test + public void resolveWhenLowercaseHeaderIsPresentThenTokenIsResolved() { + MockHttpServletRequest request = new MockHttpServletRequest(); + request.addHeader("authorization", "bearer " + TEST_TOKEN); + + assertThat(this.resolver.resolve(request)).isEqualTo(TEST_TOKEN); + } + @Test public void resolveWhenNoHeaderIsPresentThenTokenIsNotResolved() { MockHttpServletRequest request = new MockHttpServletRequest();