verikloak-rails 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d258ce7b00c8aed380623cc36b26669d86cf80c3c06e748bc677c4f8af93a4f1
-  data.tar.gz: 874e2f3c8ed2eb372d7fd4238639f4fc16e9cdd0ee6a3de7dadc57e24bbcf629
+  metadata.gz: 7d7d44a12b8963c944bc63c16ed0890ce63df67f5f6226f1db61aac701dbbc00
+  data.tar.gz: ff24126d34ee02f4eaa220c97db88e7f379657c9a26ece23f868be6ad46ecb9b
 SHA512:
-  metadata.gz: 3e035ee3bfa25ad7c9e9eb36d1279f2ea265445c60270aa2d8a8d3fcce1757cad6003892715a1faaec22cb62148bda295522ba6c12cc3bfa7858f3d2100182eb
-  data.tar.gz: c94c073924c9ed1530978aadd7abd84855e7478350572ab70338b9e8cc0a8dd7b739865517dd488b347d87a23739580b09beee206bc8aeeda4afd40d0e5ab13e
+  metadata.gz: 968b2516670f1d4dd17dc3a4c2ddbb398b26ed0bc93007612ec4ee35c84d2066b3458e3d790f4e6211183d76daffa605464d9cf645da3050ad2e34af0468f4a0
+  data.tar.gz: dc05a2a815b3be7d9d67921bcc2bc2ddcbd9afdd71264de0f421e1b666906e862cc0963f64fef883a89ac66025c27abd10de967f77ff8d32665d81e895b28c57

data/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [0.1.1] - 2025-09-13
+
+### Fixed
+- ForwardedAccessToken: fix `ensure_bearer` accepting malformed values (e.g., `BearerXYZ`).
+
+### Changed
+- Strengthen Bearer scheme normalization to always produce `Bearer <token>`.
+  - Detect scheme case-insensitively.
+  - Collapse tabs/multiple spaces after the scheme to a single space.
+  - Normalize missing-space form `BearerXYZ` to `Bearer XYZ`.
+- Add/update middleware specs to cover the above normalization.
+
 ## [0.1.0] - 2025-09-07
 
 ### Added

data/lib/verikloak/rails/middleware_integration.rb

@@ -12,6 +12,8 @@ module Verikloak
       # - Never overwrites an existing `Authorization` header
       # - Can derive the token from a prioritized list of headers
       class ForwardedAccessToken
+        BEARER_SCHEME = 'Bearer'
+        BEARER_SCHEME_LENGTH = BEARER_SCHEME.length
         # Initialize the middleware.
         #
         # @param app [#call] next Rack app
@@ -76,11 +78,28 @@ module Verikloak
           env['HTTP_AUTHORIZATION'] ||= ensure_bearer(token)
         end
 
-        # Ensure the token string is prefixed with 'Bearer '.
+        # Normalize to a proper 'Bearer <token>' header value.
+        # - Detects scheme case-insensitively
+        # - Inserts a missing space (e.g., 'BearerXYZ' => 'Bearer XYZ')
+        # - Collapses multiple spaces/tabs after the scheme to a single space
         # @param token [String]
         # @return [String]
         def ensure_bearer(token)
-          token.start_with?('Bearer') ? token : "Bearer #{token}"
+          s = token.to_s.strip
+          # Case-insensitive 'Bearer' with spaces/tabs after
+          if s =~ /\A#{BEARER_SCHEME}[ \t]+/i
+            rest = s.sub(/\A#{BEARER_SCHEME}[ \t]+/i, '')
+            return "#{BEARER_SCHEME} #{rest}"
+          end
+
+          # Case-insensitive 'Bearer' with no separator (e.g., 'BearerXYZ')
+          if s =~ /\A#{BEARER_SCHEME}(?![ \t])/i
+            rest = s[BEARER_SCHEME_LENGTH..] || ''
+            return "#{BEARER_SCHEME} #{rest}"
+          end
+
+          # No scheme present; add it
+          "#{BEARER_SCHEME} #{s}"
         end
 
         # Whether the request originates from a trusted proxy subnet.

data/lib/verikloak/rails/version.rb

@@ -2,6 +2,6 @@
 
 module Verikloak
   module Rails
-    VERSION = '0.1.0'
+    VERSION = '0.1.1'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: verikloak-rails
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - taiyaky
@@ -74,7 +74,7 @@ metadata:
   source_code_uri: https://github.com/taiyaky/verikloak-rails
   changelog_uri: https://github.com/taiyaky/verikloak-rails/blob/main/CHANGELOG.md
   bug_tracker_uri: https://github.com/taiyaky/verikloak-rails/issues
-  documentation_uri: https://rubydoc.info/gems/verikloak-rails/0.1.0
+  documentation_uri: https://rubydoc.info/gems/verikloak-rails/0.1.1
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths: