search

ajkavanagh / pyramid_jwtauth

JSON Web Token (JWT) Auth plugin for Pyramid
12 stars 9 forks source link

Non-uppercase scheme parameter results in failed permissions checks #13

Open bfin opened 8 years ago

bfin commented 8 years ago

Currently, any lowercase or mixed case scheme parameter passed to JWTAuthenticationPolicy() will fail checks because _get_params() applies the upper() method to the request's scheme name but not to the custom scheme name, to which it is compared.

Example: With scheme = 'Bearer', all of these headers currently fail auth: Authorization: Bearer token="..." Authorization: bearer token="..." Authorization: BEARER token="..." But with scheme = 'BEARER', they all pass.

As the most commonly used scheme is (probably) the mixed cased 'Bearer', it should probably not automatically fail...grin.