You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
According to RFC7235 the name of the HTTP Authorization scheme must be a case-insensitive token:
It uses a case-insensitive token as a means to identify the authentication scheme, followed by additional information necessary for achieving authentication via that scheme.
RFC7617 - Basic Auth also agrees that the scheme must be a case-insensitive token:
Note that both scheme and parameter names are matched case-insensitively.
The BasicAuthInterceptor and BearerAuthInterceptor only compare with "basic" and "bearer" which is against the specification and does not work for example when the OpenAPI specification was generated by Smithy.
karadzhov
changed the title
[BUG][Dart] Basic and Bearer auth interceptors incorrect scheme string value case
[BUG][Dart] Basic and Bearer auth interceptors case-sensitive string comparison
Nov 14, 2023
karadzhov
changed the title
[BUG][Dart] Basic and Bearer auth interceptors case-sensitive string comparison
[BUG][Dart] Basic and Bearer auth interceptors case-sensitive scheme comparison
Nov 14, 2023
Bug Report Checklist
Description
The OpenAPI specification defines the "scheme" property as:
According to RFC7235 the name of the HTTP Authorization scheme must be a case-insensitive token:
RFC7617 - Basic Auth also agrees that the scheme must be a case-insensitive token:
RFC6750 - Bearer Auth is contradicting because:
and it also defines it as "Bearer".
The BasicAuthInterceptor and BearerAuthInterceptor only compare with "basic" and "bearer" which is against the specification and does not work for example when the OpenAPI specification was generated by Smithy.
openapi-generator version
openapi-generator-cli-7.0.1.jar
OpenAPI declaration file content or url
Generation Details
Steps to reproduce
Related issues/PRs
Suggest a fix
In order to compare the strings in a case-insensitive manner, make sure that both values are in lowercase.
The text was updated successfully, but these errors were encountered: