Skip to content

Fix #116: Fix authentication scheme in HttpBearer challenge according to RFC 6750 - #118

Merged
samdark merged 2 commits into
masterfrom
fix-http-bearer-challenge
Aug 4, 2026
Merged

Fix #116: Fix authentication scheme in HttpBearer challenge according to RFC 6750#118
samdark merged 2 commits into
masterfrom
fix-http-bearer-challenge

Conversation

@samdark

@samdark samdark commented Aug 4, 2026

Copy link
Copy Markdown
Member
Q A
Is bugfix? ✔️
New feature?
Breaks BC?
Fixed issues #116

Use the Bearer authentication scheme in HttpBearer::challenge() as required by RFC 6750, instead of using the request header name. Update the corresponding challenge assertions and changelog entry.

Closes #116.

Copilot AI lite review requested due to automatic review settings August 4, 2026 14:09
@coderabbitai

coderabbitai Bot commented Aug 4, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 27463c94-b57d-49f5-b1ad-6db8392eaed0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes HttpBearer::challenge() to emit a RFC 6750-compliant WWW-Authenticate header by using the Bearer authentication scheme instead of the request header name (Authorization). This aligns bearer-auth challenges with how HttpBasic already formats its challenge and resolves issue #116.

Changes:

  • Update HttpBearer::challenge() to return WWW-Authenticate: Bearer realm="...".
  • Update unit tests asserting the bearer challenge value (HttpBearerTest, CompositeTest).
  • Add a changelog entry documenting the bug fix.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File Description
src/Method/HttpBearer.php Hardcodes the Bearer scheme in the WWW-Authenticate challenge per RFC 6750.
tests/Method/HttpBearerTest.php Updates challenge assertions to expect Bearer realm="...".
tests/Method/CompositeTest.php Updates composite challenge assertion to reflect the corrected bearer challenge.
CHANGELOG.md Documents the bug fix for #116 under the upcoming release notes.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@codecov

codecov Bot commented Aug 4, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.87%. Comparing base (4e5fe12) to head (8249141).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff            @@
##             master     #118   +/-   ##
=========================================
  Coverage     95.87%   95.87%           
  Complexity       77       77           
=========================================
  Files            10       10           
  Lines           194      194           
=========================================
  Hits            186      186           
  Misses            8        8           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

@samdark samdark changed the title Fix HTTP Bearer authentication challenge Fix #116: Fix authentication scheme in HttpBearer challenge according to RFC 6750 Aug 4, 2026
@samdark
samdark merged commit 0c82e7e into master Aug 4, 2026
30 checks passed
@samdark
samdark deleted the fix-http-bearer-challenge branch August 4, 2026 14:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

HttpBearer::challenge() produces invalid WWW-Authenticate header (violates RFC 6750)

2 participants