diff options
| author | phoet <phoetmail@googlemail.com> | 2015-02-26 16:01:26 +0100 |
|---|---|---|
| committer | phoet <phoetmail@googlemail.com> | 2015-06-01 11:41:26 +0200 |
| commit | 4b4e890781c788aa63c531d7fec19797656adda0 (patch) | |
| tree | 179fde2b7cecb1711e30e5ec6334168cbe544efc | |
| parent | 90918b5f227b77b8b4fead67cfcff9339cd13031 (diff) | |
| download | rails-4b4e890781c788aa63c531d7fec19797656adda0.tar.gz rails-4b4e890781c788aa63c531d7fec19797656adda0.tar.bz2 rails-4b4e890781c788aa63c531d7fec19797656adda0.zip | |
allow `Bearer` as well as `Token`
| -rw-r--r-- | actionpack/lib/action_controller/metal/http_authentication.rb | 2 | ||||
| -rw-r--r-- | actionpack/test/controller/http_token_authentication_test.rb | 7 |
2 files changed, 8 insertions, 1 deletions
diff --git a/actionpack/lib/action_controller/metal/http_authentication.rb b/actionpack/lib/action_controller/metal/http_authentication.rb index 32c3c9652f..fb0a52b076 100644 --- a/actionpack/lib/action_controller/metal/http_authentication.rb +++ b/actionpack/lib/action_controller/metal/http_authentication.rb @@ -397,7 +397,7 @@ module ActionController # RewriteRule ^(.*)$ dispatch.fcgi [E=X-HTTP_AUTHORIZATION:%{HTTP:Authorization},QSA,L] module Token TOKEN_KEY = 'token=' - TOKEN_REGEX = /^Token / + TOKEN_REGEX = /^(Token|Bearer) / AUTHN_PAIR_DELIMITERS = /(?:,|;|\t+)/ extend self diff --git a/actionpack/test/controller/http_token_authentication_test.rb b/actionpack/test/controller/http_token_authentication_test.rb index c854ecaf21..802c17b6bf 100644 --- a/actionpack/test/controller/http_token_authentication_test.rb +++ b/actionpack/test/controller/http_token_authentication_test.rb @@ -87,6 +87,13 @@ class HttpTokenAuthenticationTest < ActionController::TestCase assert_equal "HTTP Token: Access denied.\n", @response.body, "Authentication header was not properly parsed" end + test "successful authentication request with Bearer instead of Token" do + @request.env['HTTP_AUTHORIZATION'] = 'Bearer lifo' + get :index + + assert_response :success + end + test "authentication request without credential" do get :display |