From c8feaf0f855af88497eb61e91eae8e85b8cc94ca Mon Sep 17 00:00:00 2001 From: "Misha M.-Kupriyanov" Date: Thu, 17 Sep 2026 09:37:23 +0200 Subject: [PATCH] IONOS(user_oidc): match the bearer auth-scheme case-insensitively The Bearer-scheme guard backported in v8.6.1-d65e3f1 (upstream 2aa104a380f597e4f9088b9d46758480b9bd4a5c, nextcloud/user_oidc#1386) tests the Authorization header against the two literal spellings 'bearer ' and 'Bearer ', while the strip on the very next line is case-insensitive and accepts any whitespace separator. The guard is therefore strictly narrower than the code it protects: a client sending 'BEARER ' or 'Bearer' is refused before any token validator runs, which RFC 9110 section 11.1 forbids, since auth-scheme is a case-insensitive token. The guard now reuses the very pattern of the strip that follows it. Nothing new is accepted: a missing header, a different scheme, a missing separator and empty credentials all still resolve to no user, so the Basic-credentials storm that d65e3f1 fixed stays fixed. Proposed upstream, not yet merged there. Unlike d65e3f1 this is not an unmodified upstream commit, so it has to be dropped explicitly once an upstream release carries the fix. Fork review: IONOS-Productivity/nc-user_oidc#4 Signed-off-by: Misha M.-Kupriyanov --- lib/User/Backend.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/User/Backend.php b/lib/User/Backend.php index 2aa02777..91fa97d0 100644 --- a/lib/User/Backend.php +++ b/lib/User/Backend.php @@ -232,8 +232,11 @@ public function getCurrentUserId(): string { } // get the bearer token from headers + // the auth-scheme is case-insensitive and is separated from the credentials + // by one or more spaces or horizontal tabs (RFC 9110, section 11.1), so this + // guard has to accept exactly what the strip below removes $headerToken = $this->request->getHeader(Application::OIDC_API_REQ_HEADER); - if (!str_starts_with($headerToken, 'bearer ') && !str_starts_with($headerToken, 'Bearer ')) { + if (preg_match('/^bearer\s+/i', $headerToken) !== 1) { $this->logger->debug('No Bearer token'); return ''; }