Tolerate Authorization headers in the form 'Bearer [token]'

Author: mwtrew

app/controllers/concerns/identifiable.rb

@@ -9,8 +9,10 @@ module Identifiable
   end
 
   def load_current_user
-    token = request.headers['Authorization']
-    return if token.blank?
+    header = request.headers['Authorization']&.strip
+    return if header.blank?
+
+    token = extract_token(header)
 
     @current_user = User.from_token(token:)
     return if @current_user.blank?
@@ -19,4 +21,8 @@ def load_current_user
     RequestStore.store[:safeguarding_flag_users_by_token] ||= {}
     RequestStore.store[:safeguarding_flag_users_by_token][token] = @current_user
   end
+
+  def extract_token(header)
+    header.sub(/^Bearer\s+/i, '')
+  end
 end

spec/controllers/concerns/identifiable_spec.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Identifiable do
+  subject(:extract_token) { identifiable.extract_token(header) }
+
+  let(:identifiable) { Class.new(ActionController::API) { include Identifiable }.new }
+
+  context 'when the header is a raw token' do
+    let(:header) { nil }
+
+    it { is_expected.to eq('') }
+  end
+
+  context 'when the header is a raw token' do
+    let(:header) { 'secret-token' }
+
+    it { is_expected.to eq('secret-token') }
+  end
+
+  context 'when the header is Bearer-prefixed' do
+    let(:header) { 'Bearer secret-token' }
+
+    it { is_expected.to eq('secret-token') }
+  end
+
+  context 'when the header uses a lowercase bearer prefix' do
+    let(:header) { 'bearer secret-token' }
+
+    it { is_expected.to eq('secret-token') }
+  end
+
+  context 'when the header is Bearer with no token' do
+    let(:header) { 'Bearer ' }
+
+    it { is_expected.to eq('') }
+  end
+end