The cowboy_req:parse_header(<<"authorization">>, Req) code in Cowboy uses cow_http_hd:parse_authorization/1. The code doesn't compare case insensitive which as far as I can understand breaks RFC 2617. Both Basic, basic and other cases should be considered valid.
The
cowboy_req:parse_header(<<"authorization">>, Req)
code in Cowboy usescow_http_hd:parse_authorization/1
. The code doesn't compare case insensitive which as far as I can understand breaks RFC 2617. BothBasic
,basic
and other cases should be considered valid.The code in question: https://github.com/ninenines/cowlib/blob/master/src/cow_http_hd.erl#L891