search

thephpleague / oauth2-server

A spec compliant, secure by default PHP OAuth 2.0 Server
https://oauth2.thephpleague.com
MIT License
6.49k stars 1.12k forks source link

Authentication scheme should be matched case-insensitively #1399

Closed htvennik closed 2 months ago

htvennik commented 3 months ago

Current Behavior

HTTP Basic authentication scheme is only recognized with only first letter capitalized. This causes client credentials sent using HTTP Basic auth to be ignored if the authentication scheme is not exactly written as Basic.

Expected Behavior

HTTP authentication scheme identifier is matched case insensitively, as specified by RFC2617 section 1.2: “It uses an extensible, case-insensitive token to identify the authentication scheme“

Sephster commented 2 months ago

Thanks for reporting this. I've written a test and fixed this now. Thanks for bringing it to my attention