From 6120c31706ffaa566f2debf69e5c3b9aa5bc5896 Mon Sep 17 00:00:00 2001 From: rstoyanchev Date: Mon, 17 Feb 2025 15:19:27 +0000 Subject: [PATCH] Case-insensitive lookup of bearer auth token Closes gh-1116 --- .../BearerTokenAuthenticationExtractor.java | 19 +++++++++++++++++-- ...arerTokenAuthenticationExtractorTests.java | 10 +++++++++- 2 files changed, 26 insertions(+), 3 deletions(-) diff --git a/spring-graphql/src/main/java/org/springframework/graphql/server/support/BearerTokenAuthenticationExtractor.java b/spring-graphql/src/main/java/org/springframework/graphql/server/support/BearerTokenAuthenticationExtractor.java index 6b5fcbf2..bbc3acd9 100644 --- a/spring-graphql/src/main/java/org/springframework/graphql/server/support/BearerTokenAuthenticationExtractor.java +++ b/spring-graphql/src/main/java/org/springframework/graphql/server/support/BearerTokenAuthenticationExtractor.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2025 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -22,6 +22,7 @@ import java.util.regex.Pattern; import reactor.core.publisher.Mono; +import org.springframework.lang.Nullable; import org.springframework.security.core.Authentication; import org.springframework.security.oauth2.core.OAuth2AuthenticationException; import org.springframework.security.oauth2.server.resource.BearerTokenError; @@ -68,7 +69,7 @@ public final class BearerTokenAuthenticationExtractor implements AuthenticationE @Override public Mono getAuthentication(Map payload) { - String authorizationValue = (String) payload.get(this.authorizationKey); + String authorizationValue = getAuthorizationValue(payload); if (authorizationValue == null) { return Mono.empty(); } @@ -88,4 +89,18 @@ public final class BearerTokenAuthenticationExtractor implements AuthenticationE return Mono.just(new BearerTokenAuthenticationToken(token)); } + @Nullable + private String getAuthorizationValue(Map payload) { + String value = (String) payload.get(this.authorizationKey); + if (value != null) { + return value; + } + for (String key : payload.keySet()) { + if (key.equalsIgnoreCase(this.authorizationKey)) { + return (String) payload.get(key); + } + } + return null; + } + } diff --git a/spring-graphql/src/test/java/org/springframework/graphql/server/support/BearerTokenAuthenticationExtractorTests.java b/spring-graphql/src/test/java/org/springframework/graphql/server/support/BearerTokenAuthenticationExtractorTests.java index 25d1259b..3ca41d54 100644 --- a/spring-graphql/src/test/java/org/springframework/graphql/server/support/BearerTokenAuthenticationExtractorTests.java +++ b/spring-graphql/src/test/java/org/springframework/graphql/server/support/BearerTokenAuthenticationExtractorTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2025 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -46,6 +46,14 @@ public class BearerTokenAuthenticationExtractorTests { assertThat(auth.getName()).isEqualTo("123456789"); } + @Test // gh-1116 + void extractCaseInsensitive() { + Authentication auth = getAuthentication(Map.of("authorization", "Bearer 123456789")); + + assertThat(auth).isNotNull(); + assertThat(auth.getName()).isEqualTo("123456789"); + } + @Test void noToken() { Authentication auth = getAuthentication(Collections.emptyMap());