Header fields are not case-insensitive if specified in openapi3 configuration

Version

io.vertx:vertx-web-openapi:4.0.0.CR1

Context

According to https://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2, header field names must be case-insensitive. This is not the case though if you specify the Authorization header in the openapi3 configuration file, using the vertx-web-openapi library.

Do you have a reproducer?

Yes: https://github.com/u6f6o/vertx-web-openapi-header-bug

Steps to reproduce

1. Start the application, and try
2. curl --location --request GET 'http://localhost:8080/hello-world' --header 'authorization: fkelwfelwfew'
3. Check the output of the application (stderr)
4. Try this call: curl --location --request GET 'http://localhost:8080/hello-world' --header 'Authorization: fkelwfelwfew'

Extra

mac OS Catalina 10.15.7 Java™ SE Runtime Environment (build 14.0.1+7)

[u6f6o]

@slinkydeveloper: I built a fat jar on the branch issues/1872 and tested the headers - it worked on all different combinations 👍

[slinkydeveloper]

We decided to not verify the jwt again in the service itself and because of that, I decided back in the days to define it as a “normal” header. Might reconsider this decision though, thx for bringing it up!

Yep that was my concern, If you already checked it somewhere probably you don’t need to check it here too…

I believe though, that this issue is not limited to the Authorization header field. It applied for other fields in my test too (e.g. Foo=123 vs foo=123).

Yeah I think so, seems also an important one.