[PR #151] [MERGED] Don't send emtpy Bearer tokens #534

New issue

Closed

opened 2026-03-03 16:49:19 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 16:49:19 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/OAuthSwift/OAuthSwift/pull/151
Author: @gufo
Created: 11/26/2015
Status: ✅ Merged
Merged: 11/26/2015
Merged by: @phimage

Base: master ← Head: no-empty-bearer-tokens

📝 Commits (1)

2e60d92 Don't send emtpy Bearer tokens

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 OAuthSwift/OAuthSwiftCredential.swift (+1 -1)

📄 Description

As per RFC 6750 the syntax for Bearer authentication is as follows:

  b64token    = 1*( ALPHA / DIGIT /
                    "-" / "." / "_" / "~" / "+" / "/" ) *"="
  credentials = "Bearer" 1*SP b64token

Note the 1* which means "at least one repetition".

By definition, when one has an OAuth2 code and uses it to request an authorization token, the request cannot be made using Bearer authentication. The sent Authorization header is therefore invalid and can be rejected as a HTTP 400 (Bad Request) error.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/OAuthSwift/OAuthSwift/pull/151 **Author:** [@gufo](https://github.com/gufo) **Created:** 11/26/2015 **Status:** ✅ Merged **Merged:** 11/26/2015 **Merged by:** [@phimage](https://github.com/phimage) **Base:** `master` ← **Head:** `no-empty-bearer-tokens` --- ### 📝 Commits (1) - [`2e60d92`](https://github.com/OAuthSwift/OAuthSwift/commit/2e60d92c913057386cf69b9c80d6cccac4e52b14) Don't send emtpy Bearer tokens ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `OAuthSwift/OAuthSwiftCredential.swift` (+1 -1) </details> ### 📄 Description As per [RFC 6750](https://tools.ietf.org/html/rfc6750#section-2.1) the syntax for Bearer authentication is as follows: ``` b64token = 1*( ALPHA / DIGIT / "-" / "." / "_" / "~" / "+" / "/" ) *"=" credentials = "Bearer" 1*SP b64token ``` Note the `1*` which means "at least one repetition". By definition, when one has an OAuth2 code and uses it to request an authorization token, the request cannot be made using Bearer authentication. The sent `Authorization` header is therefore invalid and can be rejected as a HTTP 400 (Bad Request) error. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>