perf: quick way to validate token string

golang-jwt · Apr 10, 2023 · 6b99099 · 6b99099
1 parent b88a60f
commit 6b99099
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/parser.go b/parser.go
@@ -130,7 +130,7 @@ func (p *Parser) ParseUnverified(tokenString string, claims Claims) (token *Toke
 	// parse Header
 	var headerBytes []byte
 	if headerBytes, err = p.DecodeSegment(parts[0]); err != nil {
-		if strings.HasPrefix(strings.ToLower(tokenString), "bearer ") {
+		if len(tokenString) < 7 || strings.HasPrefix(strings.ToLower(tokenString[:7]), "bearer ") {
 			return token, parts, newError("tokenstring should not contain 'bearer '", ErrTokenMalformed)
 		}
 		return token, parts, newError("could not base64 decode header", ErrTokenMalformed, err)

diff --git a/request/extractor.go b/request/extractor.go
@@ -90,7 +90,7 @@ func (e BearerExtractor) ExtractToken(req *http.Request) (string, error) {
 	tokenHeader := req.Header.Get("Authorization")
 	// The usual convention is for "Bearer" to be title-cased. However, there's no
 	// strict rule around this, and it's best to follow the robustness principle here.
-	if tokenHeader == "" || !strings.HasPrefix(strings.ToLower(tokenHeader), "bearer ") {
+	if len(tokenHeader) < 7 || !strings.HasPrefix(strings.ToLower(tokenHeader[:7]), "bearer ") {
 		return "", ErrNoTokenInRequest
 	}
 	return tokenHeader[7:], nil