[cursor]

Problem

extract_bearer compared the Authorization field to a literal "Bearer " prefix. RFC 9110 makes the auth-scheme case-insensitive; RFC 6750 is "Bearer" 1*SP token68. Clients that send bearer, BEARER, or extra spaces after the scheme got 401 for a valid token. Two spaces also left a leading space on the token, so the SHA-256 lookup missed.

Fix

parse_bearer_authorization matches bearer case-insensitively, skips one or more spaces, and trims trailing OWS so a proxy-appended space is not hashed into the token. extract_bearer is the header-map lookup.

Tabs after the scheme still reject (RFC 1*SP, not HTAB). Other schemes (Basic, …) still reject.

Tests

unit_auth — canonical Bearer, case folding, extra spaces, trailing OWS, malformed/non-Bearer. 5/5 locally (+ ASan/UBSan).

Independently mergeable against main (0456350). Code hunks (auth.cpp, http_util.{h,cpp}, new test_auth.cpp, CMake unit target after unit_sse_mailbox) do not overlap #321–#339. git merge-tree --write-tree auto-merges those siblings; CHANGELOG [Unreleased] is the usual sibling note.

  

---

Note

Medium Risk
Changes authentication header parsing for all /v1/* bearer checks; behavior is broader (more inputs accepted) but aligned with standards and covered by new unit tests.

Overview
Bearer Authorization parsing now follows RFC 6750 / RFC 9110 instead of requiring an exact Bearer prefix.

A new parse_bearer_authorization in http_util treats the scheme case-insensitively (bearer, BEARER, etc.), skips one or more spaces after it, and trims trailing OWS so extra spaces do not end up in the token hash. extract_bearer only looks up the header and delegates to that helper.

Adds unit_auth doctest coverage for canonical Bearer, case folding, spacing, trailing whitespace, and malformed/non-Bearer values, plus a changelog [Unreleased] note.

^{Reviewed by Cursor Bugbot for commit 5e54fc2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_e3394a32-7f16-4fe3-857c-f6eb486d6a1e)