Skip to content

Commit 7876bd4

Browse files
spoukyiispoukyii
committed
fix(server): accept a case-insensitive DPoP authorization scheme
HTTP authentication schemes are case-insensitive (RFC 9110, section 11.1), and #23782 made the Bearer parser match its scheme that way. The DPoP parser two functions below it still required the exact prefix "DPoP ", so a proof-bound client that wrote "dpop <token>" had its valid credential and proof refused as if it sent none. parseDpopToken now matches its scheme case-insensitively, like parseBearerToken. The check that adds the DPoP challenge to an unauthorized response matches the same way, so a refused request with either spelling gets the same challenge. Bug: a DPoP Authorization header is rejected unless its scheme is spelled exactly "DPoP"
1 parent 9de4dc2 commit 7876bd4

2 files changed

Lines changed: 2 additions & 2 deletions

File tree

‎apps/server/src/auth/EnvironmentAuth.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -640,7 +640,7 @@ export function parseBearerToken(request: HttpServerRequest.HttpServerRequest):
640640

641641
function parseDpopToken(request: HttpServerRequest.HttpServerRequest): string | null {
642642
const header = request.headers["authorization"];
643-
if (typeof header !== "string" || !header.startsWith(DPOP_AUTHORIZATION_PREFIX)) {
643+
if (typeof header !== "string" || !/^DPoP /i.test(header)) {
644644
return null;
645645
}
646646
const token = header.slice(DPOP_AUTHORIZATION_PREFIX.length).trim();

‎apps/server/src/auth/http.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ const appendDpopChallengeOnUnauthorized =
5757
const request = yield* HttpServerRequest.HttpServerRequest;
5858
const usesDpop =
5959
(request.originalUrl.startsWith("/oauth/token") && request.headers.dpop !== undefined) ||
60-
request.headers.authorization?.startsWith("DPoP ") === true;
60+
/^DPoP /i.test(request.headers.authorization ?? "");
6161
if (usesDpop) {
6262
yield* appendDpopChallengeHeader;
6363
}

0 commit comments

Comments
 (0)