pallets-eco / flask-jwt

JWT (JSON Web Tokens) for Flask applications
MIT License
564 stars 178 forks source link

IndexError: list index out of range on Authorization header set to empty string #61

Closed boromil closed 8 years ago

boromil commented 8 years ago

full stack trace:

Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/flask/app.py", line 1836, in __call__
    return self.wsgi_app(environ, start_response)
  File "/usr/local/lib/python2.7/dist-packages/flask/app.py", line 1820, in wsgi_app
    response = self.make_response(self.handle_exception(e))
  File "/usr/local/lib/python2.7/dist-packages/flask/app.py", line 1403, in handle_exception
    reraise(exc_type, exc_value, tb)
  File "/usr/local/lib/python2.7/dist-packages/flask/app.py", line 1817, in wsgi_app
    response = self.full_dispatch_request()
  File "/usr/local/lib/python2.7/dist-packages/flask/app.py", line 1477, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/usr/local/lib/python2.7/dist-packages/flask/app.py", line 1381, in handle_user_exception
    reraise(exc_type, exc_value, tb)
  File "/usr/local/lib/python2.7/dist-packages/flask/app.py", line 1475, in full_dispatch_request
    rv = self.dispatch_request()
  File "/usr/local/lib/python2.7/dist-packages/flask/app.py", line 1461, in dispatch_request
    return self.view_functions[rule.endpoint](**req.view_args)
  File "/usr/local/lib/python2.7/dist-packages/flask_jwt/__init__.py", line 176, in decorator
    _jwt_required(realm or current_app.config['JWT_DEFAULT_REALM'])
  File "/usr/local/lib/python2.7/dist-packages/flask_jwt/__init__.py", line 151, in _jwt_required
    token = _jwt.request_callback()
  File "/usr/local/lib/python2.7/dist-packages/flask_jwt/__init__.py", line 103, in _default_request_handler
    if parts[0].lower() != auth_header_prefix.lower():
IndexError: list index out of range

think that _requesthandler should have an additional check, for example:

auth_header_value = request.headers.get('Authorization', None)
if auth_header_value == '':
    raise JWTError('Invalid JWT header', 'Empty value')