Function TestAPITokenFromRequest

coderd/httpmw/rfc6750_test.go:157–231

TestAPITokenFromRequest tests the RFC 6750 bearer token extraction directly

(t *testing.T)

// TestAPITokenFromRequest tests the RFC 6750 bearer token extraction directly
func TestAPITokenFromRequest(t *testing.T) {
	t.Parallel()

	token := "test-token-value"
	customToken := "custom-token"
	cookieToken := "cookie-token"

	tests := []struct {
		name     string
		setupReq func(*http.Request)
		expected string
	}{
		{
			name: "AuthorizationBearerHeader",
			setupReq: func(req *http.Request) {
				req.Header.Set("Authorization", "Bearer "+token)
			},
			expected: token,
		},
		{
			name: "AccessTokenQueryParameter",
			setupReq: func(req *http.Request) {
				q := req.URL.Query()
				q.Set("access_token", token)
				req.URL.RawQuery = q.Encode()
			},
			expected: token,
		},
		{
			name: "CustomMethodsPriorityOverBearer",
			setupReq: func(req *http.Request) {
				req.Header.Set(codersdk.SessionTokenHeader, customToken)
				req.Header.Set("Authorization", "Bearer "+token)
			},
			expected: customToken,
		},
		{
			name: "CookiePriorityOverBearer",
			setupReq: func(req *http.Request) {
				req.AddCookie(&http.Cookie{
					Name:  codersdk.SessionTokenCookie,
					Value: cookieToken,
				})
				req.Header.Set("Authorization", "Bearer "+token)
			},
			expected: cookieToken,
		},
		{
			name: "NoTokenReturnsEmpty",
			setupReq: func(req *http.Request) {
				// No authentication provided
			},
			expected: "",
		},
		{
			name: "InvalidAuthorizationHeaderIgnored",
			setupReq: func(req *http.Request) {
				req.Header.Set("Authorization", "Basic dXNlcjpwYXNz") // Basic auth, not Bearer