healthchecks / healthchecks / 22991965828

91%

push

github

Fix incorrect Bearer token handling in the Prometheus metrics endpoint

The "Bearer " prefix was removed from the Authorization header
incorrectly with str.lstrip(). This could mangle the token (if
the token starts with "B", "e", "a", or "r") and result in
HTTP 400 responses from the server. The fix is to use
str.removeprefix() instead.

This bug is not a security issue: there was no chance that an invalid
key would have been accepted as valid, only vice-versa.

1 of 1 new or added line in 1 file covered. (100.0%)

8249 of 9015 relevant lines covered (91.5%)

0.92 hits per line