fix: validate authorization schema

lib/verifyBearerAuthFactory.js

@@ -25,9 +25,8 @@ module.exports = function verifyBearerAuthFactory (options) {
   }
 
   return function verifyBearerAuth (request, reply, done) {
-    const header = request.raw.headers.authorization
-    if (!header) {
-      const noHeaderError = Error('missing authorization header')
+    function authorizationHeaderErrorFn (errorMessage) {
+      const noHeaderError = Error(errorMessage)
       if (verifyErrorLogLevel) request.log[verifyErrorLogLevel]('unauthorized: %s', noHeaderError.message)
       if (contentType) reply.header('content-type', contentType)
       reply.code(401)
@@ -36,10 +35,19 @@ module.exports = function verifyBearerAuthFactory (options) {
         return
       }
       reply.send(errorResponse(noHeaderError))
-      return
+    }
+
+    const header = request.raw.headers.authorization
+    if (!header) {
+      return authorizationHeaderErrorFn('missing authorization header')
     }
 
     const key = header.substring(bearerType.length).trim()
+    const type = header.substring(0, bearerType.length)
+    if (type.toLowerCase() !== bearerType.toLowerCase()) {
+      return authorizationHeaderErrorFn('invalid authorization header')
+    }
+
     let retVal
     // check if auth function is defined
     if (auth && auth instanceof Function) {

test/verifyBearerAuthFactory.test.js

@@ -55,6 +55,73 @@ test('hook rejects for missing header with custom content type', (t) => {
   hook(request, response)
 })
 
+test('hook rejects for wrong bearer type but same string length as `bearer`', (t) => {
+  t.plan(2)
+
+  const request = {
+    log: { error: noop },
+    raw: { headers: { authorization: `reraeB ${key}` } }
+  }
+  const response = {
+    code: () => response,
+    send
+  }
+
+  function send (body) {
+    t.ok(body.error)
+    t.match(body.error, /invalid authorization header/)
+  }
+
+  const hook = verifyBearerAuthFactory()
+  hook(request, response)
+})
+
+test('hook rejects for wrong bearer type', (t) => {
+  t.plan(2)
+
+  const request = {
+    log: { error: noop },
+    raw: { headers: { authorization: `fake-bearer ${key}` } }
+  }
+  const response = {
+    code: () => response,
+    send
+  }
+
+  function send (body) {
+    t.ok(body.error)
+    t.match(body.error, /invalid authorization header/)
+  }
+
+  const hook = verifyBearerAuthFactory()
+  hook(request, response)
+})
+
+test('hook rejects for wrong alternate Bearer', (t) => {
+  t.plan(2)
+
+  const bearerAlt = 'BearerAlt'
+  const keysAlt = { keys: new Set([key]), bearerType: bearerAlt }
+  const request = {
+    log: { error: noop },
+    raw: {
+      headers: { authorization: `tlAreraeB ${key}` }
+    }
+  }
+  const response = {
+    code: () => response,
+    send
+  }
+
+  function send (body) {
+    t.ok(body.error)
+    t.match(body.error, /invalid authorization header/)
+  }
+
+  const hook = verifyBearerAuthFactory(keysAlt)
+  hook(request, response)
+})
+
 test('hook rejects header without bearer prefix', (t) => {
   t.plan(2)