question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Headers in lowercase, including bearer

See original GitHub issue
Q A
Bug or feature request? Bug
Which Swagger/OpenAPI version? 2.0
Which Swagger-UI version? 3.1.5
How did you install Swagger-UI? download of dist folder
Which broswer & version? Chrome Version 60.0.3112.90 (Official Build) (64-bit)
Which operating system? Mac OS 10.12.6

Demonstration API definition

API with OAuth2 support

Configuration (browser query string, constructor, config.yaml)

Defaults

Expected Behavior

I authorized swagger-ui using the default settings, against my OAuth 2 server, with the “implicit” grant.

When using “try it out”, it sends the following headers: -H "accept: application/json" -H "authorization: bearer ..."

At least the “bearer” part of this should be uppercase: https://tools.ietf.org/html/rfc6750

Also, I think it’s more standard to send title-case headers, although they’re technically case-insensitive.

Current Behavior

“bearer” is lowercase.

Possible Solution

Context

Issue Analytics

  • State:closed
  • Created 6 years ago
  • Comments:8 (6 by maintainers)

github_iconTop GitHub Comments

3reactions
webroncommented, Sep 19, 2017

When it comes to the value of a header, we should never change the lettering case.

1reaction
shockeycommented, Oct 16, 2017

This was just fixed in https://github.com/swagger-api/swagger-js/pull/1156. Swagger-UI will receive the patch as part of our release this Friday 🎉

Closing!

Read more comments on GitHub >

github_iconTop Results From Across the Web

Bearer in lowercase in authorization header · Issue #45 - GitHub
Hi, In keycloak.service.ts our team discovered that the lowercase "bearer" in the authorisation header causes issues with Spring Web.
Read more >
Fixing go-oauth2's case sensitive bearer token authorization ...
On the other hand, RFC 6750 section 2.1 states that the Authorization header scheme for bearer tokens must be capitalized: Clients should make ......
Read more >
Change authorization header to case insensitive header
An API request with Authorization and token_type "bearer" ... The request returns an invalid "token_type" with lowercase 'b', ...
Read more >
Are HTTP headers case-sensitive? - Stack Overflow
Answer is still true, RFC 7230 states: "Each header field consists of a case-insensitive field name followed by a colon (":"), optional leading...
Read more >
HTTP client request headers (lowercase) issue - Google Groups
A recent update changed how client request headers are sent to force all headers to lowercase. This is causing problems with some well-established...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found