raystack / frontier / 27009627415

43%

main: 43%

Pull #1677

github

fix(auth): require Bearer/Basic scheme and route exclusively

The Authorization header parser used strings.TrimPrefix, which is a no-op
when the prefix is absent. As a result a bare PAT (no scheme) was treated
as a token, a bare base64 credential was treated as a secret, and every
Bearer header also leaked into the secret slot because both blocks ran
unconditionally. Scheme matching was also case-sensitive, breaking
RFC 7235.

Replace the parser with a small helper that requires the scheme, matches
it case-insensitively via strings.EqualFold, and routes Bearer to
UserTokenGatewayKey and Basic to UserSecretGatewayKey — never both.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

23 of 23 new or added lines in 1 file covered. (100.0%)

16510 of 38036 relevant lines covered (43.41%)

12.21 hits per line