Function TestOAuth2BearerTokenMalformedHeaders

coderd/httpmw/rfc6750_extended_test.go:151–230

TestOAuth2BearerTokenMalformedHeaders tests handling of malformed Bearer headers per RFC 6750 nolint:tparallel,paralleltest // Subtests share a DB; run sequentially to avoid Windows DB cleanup flake.

(t *testing.T)

//
//nolint:tparallel,paralleltest // Subtests share a DB; run sequentially to avoid Windows DB cleanup flake.
func TestOAuth2BearerTokenMalformedHeaders(t *testing.T) {
	t.Parallel()

	db, _ := dbtestutil.NewDB(t)

	middleware := httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{
		DB: db,
	})

	handler := middleware(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
		rw.WriteHeader(http.StatusOK)
	}))

	tests := []struct {
		name           string
		authHeader     string
		expectedStatus int
		shouldHaveWWW  bool
	}{
		{
			name:           "MissingBearer",
			authHeader:     "invalid-token",
			expectedStatus: http.StatusUnauthorized,
			shouldHaveWWW:  true,
		},
		{
			name:           "CaseSensitive",
			authHeader:     "bearer token", // lowercase should still work
			expectedStatus: http.StatusUnauthorized,
			shouldHaveWWW:  true,
		},
		{
			name:           "ExtraSpaces",
			authHeader:     "Bearer  token-with-extra-spaces",
			expectedStatus: http.StatusUnauthorized,
			shouldHaveWWW:  true,
		},
		{
			name:           "EmptyToken",
			authHeader:     "Bearer ",
			expectedStatus: http.StatusUnauthorized,
			shouldHaveWWW:  true,
		},
		{
			name:           "OnlyBearer",
			authHeader:     "Bearer",
			expectedStatus: http.StatusUnauthorized,
			shouldHaveWWW:  true,
		},
		{
			name:           "MultipleBearer",
			authHeader:     "Bearer token1 Bearer token2",
			expectedStatus: http.StatusUnauthorized,
			shouldHaveWWW:  true,
		},
		{
			name:           "InvalidBase64",
			authHeader:     "Bearer !!!invalid-base64!!!",