feat: do not send non-JWTs in Authorization header
#1293
Conversation
Pull Request Test Coverage Report for Build 11540641030Details
💛 - Coveralls |
hf
force-pushed
the
hf/dont-send-non-jwts-in-authorization
branch
from
7563e9a
to
a70f6cf
Compare
hf
force-pushed
the
hf/dont-send-non-jwts-in-authorization
branch
from
a70f6cf
to
6193a96
Compare
There was a problem hiding this comment.
@hf just a few things to confirm:
- Users don't need to upgrade their
supabase-jsversion to use the new API keys - This change just helps to ease the transition since upgrading the client lib version will provide more information about any unforseen errors. Our api-gateway already ignores checking the
Authorizationheader and only looks at theapikeyheader.
| if (headers.authorization && headers.Authorization) { | ||
| console.warn( | ||
| '@supabase-js: Both `authorization` and `Authorization` headers specified in createClient options. `Authorization` will be used.' | ||
| ) |
There was a problem hiding this comment.
can we initialise the headers field using the Headers interface instead since it's case-insensitive? (https://developer.mozilla.org/en-US/docs/Web/API/Headers)
| return | ||
| } | ||
|
|
||
| if (authorization.startsWith('Bearer ') && authorization.length > 'Bearer '.length) { |
There was a problem hiding this comment.
authorization.length > 'Bearer '.length
not immediately obvious what this check is for?
There was a problem hiding this comment.
Looks like it's making sure that we only check for a valid JWT if the authorization header actually has a value after "Bearer ".
It's worth noting that this check will not cover a scenario where someone only passes in "Bearer" (without a trailing space), but I'm guessing this whole scenario would be extremely rare anyway. Still, you might consider covering both.
In preparation for the introduction of new API keys, the client library should not pass non-JWT values in the
Authorizationheader, as requests like this will definitely fail.Two backward compatible changes are introduced:
createClient()with a non-JWT Supabase Key will not forward it as theAuthorization: Bearer <...>header.createClient()with global header options that contains a non-JWT in theAuthorizationheader will throw an error.