36 lines
1.1 KiB
Go
36 lines
1.1 KiB
Go
package auth
|
|
|
|
import "strings"
|
|
|
|
// ParseBearerToken parses an RFC 6750 Bearer authorization value. The scheme is
|
|
// case-insensitive; tokens must use the b64token alphabet and contain no spaces.
|
|
// Parsing does not validate the token's signature or grant authorization.
|
|
func ParseBearerToken(header string) (string, error) {
|
|
// Bound before scanning, including an allowance for separator spaces.
|
|
if len(header) > MaxTokenLen+16 {
|
|
return "", ErrTokenTooLong
|
|
}
|
|
scheme, token, ok := strings.Cut(header, " ")
|
|
if !ok || !strings.EqualFold(scheme, "Bearer") {
|
|
return "", ErrAuthInvalidBearerFormat
|
|
}
|
|
token = strings.TrimLeft(token, " ")
|
|
if token == "" {
|
|
return "", ErrAuthEmptyBearerToken
|
|
}
|
|
if len(token) > MaxTokenLen {
|
|
return "", ErrTokenTooLong
|
|
}
|
|
padding := false
|
|
for i, ch := range []byte(token) {
|
|
if ch == '=' && i > 0 {
|
|
padding = true
|
|
continue
|
|
}
|
|
if padding || !(ch >= 'a' && ch <= 'z' || ch >= 'A' && ch <= 'Z' || ch >= '0' && ch <= '9' || strings.ContainsRune("-._~+/", rune(ch))) {
|
|
return "", ErrAuthInvalidBearerFormat
|
|
}
|
|
}
|
|
return token, nil
|
|
}
|