From c59ea167fd5d8950070de10dc7835dd587c1d6c0 Mon Sep 17 00:00:00 2001 From: avsan Date: Tue, 1 Sep 2026 02:55:49 +0530 Subject: [PATCH] Allow multiple spaces in bearer authorization header Accept one or more spaces between the Bearer authentication scheme and token as allowed by RFC 6750. Add regression coverage for authorization headers containing multiple spaces before the token. Closes gh-19500 Signed-off-by: avsan --- .../server/resource/web/DefaultBearerTokenResolver.java | 2 +- .../resource/web/DefaultBearerTokenResolverTests.java | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolver.java b/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolver.java index eaa2f3ecaae..7505100c81a 100644 --- a/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolver.java +++ b/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolver.java @@ -42,7 +42,7 @@ public final class DefaultBearerTokenResolver implements BearerTokenResolver { private static final String ACCESS_TOKEN_PARAMETER_NAME = "access_token"; - private static final Pattern authorizationPattern = Pattern.compile("^Bearer (?[a-zA-Z0-9-._~+/]+=*)$", + private static final Pattern authorizationPattern = Pattern.compile("^Bearer +(?[a-zA-Z0-9-._~+/]+=*)$", Pattern.CASE_INSENSITIVE); private boolean allowFormEncodedBodyParameter = false; diff --git a/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolverTests.java b/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolverTests.java index f9e317119b7..10cbd889558 100644 --- a/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolverTests.java +++ b/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolverTests.java @@ -327,5 +327,11 @@ public void resolveWhenFormParameterIsPresentAndEmptyStringThenTokenIsNotResolve assertThat(error.getHttpStatus()).isEqualTo(HttpStatus.BAD_REQUEST); }); } +@Test +void resolveWhenHeaderHasMultipleSpacesBeforeTokenThenTokenIsResolved() { + MockHttpServletRequest request = new MockHttpServletRequest(); + request.addHeader("Authorization", "Bearer " + TEST_TOKEN); + assertThat(this.resolver.resolve(request)).isEqualTo(TEST_TOKEN); +} }