fix: add cookie support for HTTP bearer authentication

[SeokHoChoi]

Overview

In my project, we use HTTP-only cookies exclusively for sending authentication tokens, and the Authorization header is not required. I encountered issues with the current validateHttp() implementation because it only validates tokens in the Authorization header. To address this, I made a minor adjustment to check for tokens in both the Authorization header and cookies.

Changes

• Updated validateHttp() to look for bearer tokens in cookies, in addition to the Authorization header.

Reason for Change

Typically, HTTP authentication relies on the Authorization header, as token-based authentication often uses headers according to REST API standards. However, when using HTTP-only cookies—especially in setups that employ CSRF protection—this is a common approach for managing tokens.

I’ve made these changes to provide more flexibility for projects that use cookies for authentication. I wanted to propose this adjustment and get feedback on whether this approach aligns with broader use cases or if there are other considerations.

I didn't even touch the associated test code for quick post-application feedback!

Let me know your thoughts on this modification!

[cdimascio]

thanks so much for the CR!
i'm requesting a small update here.
Please retain the existing error message when !authHeader (and the securitySchemw does not specify in: cookie. When in: cookie is specified by the securityScheme throw Cookie authentication required. ref: https://swagger.io/docs/specification/authentication/cookie-authentication/

[SeokHoChoi]

thanks so much for the CR! i'm requesting a small update here. Please retain the existing error message when !authHeader (and the securitySchemw does not specify in: cookie. When in: cookie is specified by the securityScheme throw Cookie authentication required. ref: https://swagger.io/docs/specification/authentication/cookie-authentication/

Thanks for the detailed code review.!!

Implemented the requested changes:

• Updated auth validation in AuthValidator class
• Added checks for cookie-based authentication
• Refined error handling for header and cookie auth
• Updated error messages as suggested

PR updated and ready for another look. Let me know if anything else needs adjustment.

[cdimascio]

@SeokHoChoi there are two tests that are failing, can you have a look and resolve. once, working, i'll get this merged in

  431 passing (6s)
  4 pending
  2 failing

  1) security.defaults
       should skip validation, even if auth header is missing for basic auth:

      AssertionError: expected 'Cannot read properties of undefined (…' to equal 'Authorization header required'
      + expected - actual

      -Cannot read properties of undefined (reading 'includes')
      +Authorization header required
      
      at /home/runner/work/express-openapi-validator/express-openapi-validator/test/security.defaults.spec.ts:43:17
      at processTicksAndRejections (node:internal/process/task_queues:95:5)

  2) security.handlers
       should return 401 if auth header is missing for basic auth:
     AssertionError: expected 'Cannot read properties of undefined (…' to include 'Authorization'
      at /home/runner/work/express-openapi-validator/express-openapi-validator/test/security.handlers.spec.ts:204:43
      at processTicksAndRejections (node:internal/process/task_queues:95:5)
      ```

[SeokHoChoi]

@SeokHoChoi there are two tests that are failing, can you have a look and resolve. once, working, i'll get this merged in

  431 passing (6s)
  4 pending
  2 failing

  1) security.defaults
       should skip validation, even if auth header is missing for basic auth:

      AssertionError: expected 'Cannot read properties of undefined (…' to equal 'Authorization header required'
      + expected - actual

      -Cannot read properties of undefined (reading 'includes')
      +Authorization header required
      
      at /home/runner/work/express-openapi-validator/express-openapi-validator/test/security.defaults.spec.ts:43:17
      at processTicksAndRejections (node:internal/process/task_queues:95:5)

  2) security.handlers
       should return 401 if auth header is missing for basic auth:
     AssertionError: expected 'Cannot read properties of undefined (…' to include 'Authorization'
      at /home/runner/work/express-openapi-validator/express-openapi-validator/test/security.handlers.spec.ts:204:43
      at processTicksAndRejections (node:internal/process/task_queues:95:5)
      ```

Thank you for pointing out the failing tests! I've updated the code to fix the issues.

I've restructured the validation logic to handle both Bearer and Basic authentication properly:

1. For Basic auth, I now check for the existence of the authorization header first before attempting to access its properties
2. For Bearer auth, I've maintained the existing behavior while adding cookie support when specified

The changes should now pass all tests while maintaining the expected error messages. Please let me know if you'd like me to make any additional adjustments!

[cdimascio]

thank you!