From 6b99099ef253d8d58a509aa4ca24216ee50bb5bd Mon Sep 17 00:00:00 2001 From: "zhouyiheng.go" Date: Mon, 10 Apr 2023 10:45:20 +0800 Subject: [PATCH] perf: quick way to validate token string --- parser.go | 2 +- request/extractor.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/parser.go b/parser.go index f4386fba..e86e510a 100644 --- a/parser.go +++ b/parser.go @@ -130,7 +130,7 @@ func (p *Parser) ParseUnverified(tokenString string, claims Claims) (token *Toke // parse Header var headerBytes []byte if headerBytes, err = p.DecodeSegment(parts[0]); err != nil { - if strings.HasPrefix(strings.ToLower(tokenString), "bearer ") { + if len(tokenString) < 7 || strings.HasPrefix(strings.ToLower(tokenString[:7]), "bearer ") { return token, parts, newError("tokenstring should not contain 'bearer '", ErrTokenMalformed) } return token, parts, newError("could not base64 decode header", ErrTokenMalformed, err) diff --git a/request/extractor.go b/request/extractor.go index 780721b6..03d8e4b7 100644 --- a/request/extractor.go +++ b/request/extractor.go @@ -90,7 +90,7 @@ func (e BearerExtractor) ExtractToken(req *http.Request) (string, error) { tokenHeader := req.Header.Get("Authorization") // The usual convention is for "Bearer" to be title-cased. However, there's no // strict rule around this, and it's best to follow the robustness principle here. - if tokenHeader == "" || !strings.HasPrefix(strings.ToLower(tokenHeader), "bearer ") { + if len(tokenHeader) < 7 || !strings.HasPrefix(strings.ToLower(tokenHeader[:7]), "bearer ") { return "", ErrNoTokenInRequest } return tokenHeader[7:], nil