search

jshttp / basic-auth

Generic basic auth Authorization header field parser
MIT License
703 stars 86 forks source link

Header is case sensitive #43

Closed Siilwyn closed 5 years ago

Siilwyn commented 5 years ago

While debugging some code running in a lambda environment I figured that basic-auth is not working since Authorization is used with a capital 'A'.

Instead of retrieving the value with headers.authorization something like this should work:

headers [Object.keys(headers).find(key => key.toLowerCase() === 'authorization')]

This would comply with the spec, headers should not be case sensitive: https://stackoverflow.com/questions/5258977/are-http-headers-case-sensitive

Siilwyn commented 5 years ago

Related: https://github.com/serverless/serverless/issues/2765

dougwilson commented 5 years ago

The req.headers is defined by Node.js to only contain lower-case keys. You need to pass in an object that complies with their interface to this module if you're passing in a req object.

https://nodejs.org/dist/latest-v10.x/docs/api/http.html#http_message_headers

Key-value pairs of header names and values. Header names are lower-cased.

Siilwyn commented 5 years ago

@dougwilson ah that makes sense, maybe link to it from the readme?

dougwilson commented 5 years ago

Absolutely! Looks like you already opened a pull request.

hoang-innomize commented 5 years ago

I am facing this issue too. In the event.headers, some our custom headers are converted to lowercase. Such as on the FE we are sending X-Header-A, but on the event object, we received x-header-a as the header key