extractCoderTokenFromProxyAuth extracts the Coder token from the Proxy-Authorization header. The token is expected to be in the password field of basic auth: "Basic base64(username:token)". Returns empty string if no valid token is found.
(proxyAuth string)
| 724 | // |
| 725 | // Returns empty string if no valid token is found. |
| 726 | func extractCoderTokenFromProxyAuth(proxyAuth string) string { |
| 727 | if proxyAuth == "" { |
| 728 | return "" |
| 729 | } |
| 730 | |
| 731 | // Expected format: "Basic base64(username:password)" |
| 732 | // Auth scheme is case-insensitive per RFC 7235. |
| 733 | parts := strings.Fields(proxyAuth) |
| 734 | if len(parts) != 2 || !strings.EqualFold(parts[0], "Basic") { |
| 735 | return "" |
| 736 | } |
| 737 | |
| 738 | decoded, err := base64.StdEncoding.DecodeString(parts[1]) |
| 739 | if err != nil { |
| 740 | return "" |
| 741 | } |
| 742 | |
| 743 | // Format: "username:password", password is the Coder token. |
| 744 | // Username is ignored and can be any value. |
| 745 | credentials := strings.SplitN(string(decoded), ":", 2) |
| 746 | if len(credentials) != 2 { |
| 747 | return "" |
| 748 | } |
| 749 | |
| 750 | return credentials[1] |
| 751 | } |
| 752 | |
| 753 | // extractCoderTokenFromBearerAuth extracts the bearer token from an |
| 754 | // Authorization header. Returns empty string if the header is not a |
no test coverage detected