diff --git a/router/middleware/auth.go b/router/middleware/auth.go index 00e8dfc60..574610cdf 100644 --- a/router/middleware/auth.go +++ b/router/middleware/auth.go @@ -69,10 +69,13 @@ func RequireExternalAPIAccessToken(scope string, handler ExternalAccessTokenHand return } - authHeader := strings.Split(r.Header.Get("Authorization"), "Bearer ") - token := strings.Join(authHeader, "") + authHeader := r.Header.Get("Authorization") + token := "" + if strings.HasPrefix(strings.ToLower(authHeader), "bearer ") { + token = authHeader[len("bearer "):] + } - if len(authHeader) == 0 || token == "" { + if token == "" { log.Warnln("invalid access token") accessDenied(w) return diff --git a/test/automated/api/integrations.test.js b/test/automated/api/integrations.test.js index 4b1ab345b..17914625e 100644 --- a/test/automated/api/integrations.test.js +++ b/test/automated/api/integrations.test.js @@ -83,7 +83,7 @@ test('send a system message using access token', async (done) => { }; const res = await request .post('/api/integrations/chat/system') - .set('Authorization', 'Bearer ' + accessToken) + .set('Authorization', 'bearer ' + accessToken) .send(payload) .expect(200); done();