Visitar URL original
fix(api): match the OIDC Bearer scheme case-insensitively by MaxFreedomPollard · Pull Request #1696 · gotenberg/gotenberg · GitHub
Skip to content

fix(api): match the OIDC Bearer scheme case-insensitively - #1696

Merged
gulien merged 1 commit into
gotenberg:mainfrom
MaxFreedomPollard:fix/oidc-bearer-scheme-case
Oct 25, 2026
Merged

fix(api): match the OIDC Bearer scheme case-insensitively#1696
gulien merged 1 commit into
gotenberg:mainfrom
MaxFreedomPollard:fix/oidc-bearer-scheme-case

Conversation

@MaxFreedomPollard

@MaxFreedomPollard MaxFreedomPollard commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

With --api-enable-oidc-auth, a request that spells the Authorization scheme in another case, such as bearer <token> or BEARER <token>, gets a 401 "a Bearer token is required in the Authorization header", even when the token is valid. Only the exact spelling Bearer passes.

oidcAuthMiddleware (pkg/modules/api/middlewares.go:431) cuts the literal prefix "Bearer " with strings.CutPrefix, so any other spelling fails before the token reaches the verifier. An authentication scheme is a case-insensitive token (RFC 9110, section 11.1), and an OAuth 2.0 token_type value is case-insensitive too (RFC 6749, section 5.1), so a client that builds the header from a token response can legitimately send bearer. Basic auth already accepts any case: Echo's BasicAuth middleware, which basicAuthMiddleware wraps, matches its scheme with strings.EqualFold.

The fix splits the header value on its first space and compares the scheme with strings.EqualFold. Every other input keeps its outcome: a missing header, another scheme, Bearer with no token, and a scheme with no space after it still answer 401 before verification, and the token is verified exactly as before.

Tests: three cases in the existing TestOidcAuthMiddleware table. bearer <token> and BEARER <token> pass; Bearer<token> is rejected.

Not compiled or run locally: no Go toolchain was available where this was written, so CI is the first compile and test run.

Backward compatibility: no CLI flag, environment variable, form field, route or default changes. The only behavior change is that a valid token sent with a differently cased scheme is accepted.

🤖 Generated with Claude Code

@MaxFreedomPollard @claude
fix(api): match the OIDC Bearer scheme case-insensitively
434a272 
The OIDC middleware cut the literal prefix "Bearer " from the
Authorization header, so "bearer <token>" or "BEARER <token>" got a 401
before the token was verified. An authentication scheme is a
case-insensitive token (RFC 9110, section 11.1), and an OAuth 2.0
token_type value is case-insensitive too (RFC 6749, section 5.1), so a
client that builds the header from a token response may send it in
lower case. The basic auth middleware already matches "Basic" in any
case.

Split the header on the first space and compare the scheme with
strings.EqualFold. Every other input keeps its current outcome.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@gulien gulien added enhancement New feature or request bug Something isn't working and removed enhancement New feature or request labels Oct 25, 2026
@gulien
gulien merged commit dbbf039 into gotenberg:main Oct 25, 2026
15 of 16 checks passed
@gulien

gulien commented Oct 25, 2026

Copy link
Copy Markdown
Collaborator

Thanks @MaxFreedomPollard, great catch and fix! 🙏

hbjydev pushed a commit to hbjydev/phoebe that referenced this pull request Oct 27, 2026
hayden-bot git.hayden.moe Instance
feat(image): update image gotenberg/gotenberg (8.38.1 → 8.39.0) (#1021)
e51bd60 
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [gotenberg/gotenberg](https://github.com/gotenberg/gotenberg) | minor | `8.38.1` → `8.39.0` |

---

### Release Notes

<details>
<summary>gotenberg/gotenberg</summary>

### [`v8.39.0`](https://github.com/gotenberg/gotenberg/releases/tag/v8.39.0): 8.39.0

[Compare Source](gotenberg/gotenberg@v8.38.1...v8.39.0)

##### Security Fixes ⚠️

- **Reject ExifTool's `j` option alias and stop loading ExifTool config files.** The metadata check blocked `json` but not its alias `j`. A metadata key could import a JSON file carrying a `HardLink` pseudo-tag, plant `~/.ExifTool_config`, and have the next ExifTool run execute it as Perl. The keys `j`, `addtagsfromfile`, and `alltagsfromfile` now return `400`, and Gotenberg always runs ExifTool with `-config ""`.
- **Accept only `http://` and `https://` URLs on the URL routes.** The default deny-list only covered `file://`, so `devtools://devtools/bundled/devtools_app.html` loaded Chromium's privileged DevTools page, and `waitForExpression` ran there with access to local files. `/forms/chromium/convert/url` and `/forms/chromium/screenshot/url` now return `400` for any other scheme.
- **Apply path and `wss://` deny rules to WebSocket handshakes.** The pinning proxy matched CONNECT tunnels against `https://host:port`, so a deny rule anchored on a path, such as `^https?://host/`, or on `wss://` refused the plain request but let the handshake through. The proxy now matches tunnels against each scheme's root URL, and a handshake whose full URL is denied fails the conversion with a generic `403`.
- **Drop the compromised eMudhra roots** ([#&#8203;1699](gotenberg/gotenberg#1699)). The images trusted `emSign ECC Root CA - G3` and `AAA Certificate Services`, whose intermediates have recoverable private keys. The OS bundle now comes from `ca-certificates` `20250419+deb13u1`, the Java trust store used by PDFtk drops both roots, and Chromium 156 rejects them. Thanks [@&#8203;hrueger](https://github.com/hrueger).

##### New Features

- **`failOnConsoleMessageTypes` for Chromium** ([#&#8203;1667](gotenberg/gotenberg#1667)). Fails the conversion with `409` when the page logs a console message of one of the given types (`log`, `debug`, `info`, `warning`, `error`, `assert`). The response lists the messages. Thanks [@&#8203;jschneider](https://github.com/jschneider).
- **PDF/A-4** ([#&#8203;1703](gotenberg/gotenberg#1703)). The `pdfa` form field now accepts `PDF/A-4` on every route that supports it, through the LibreOffice PDF engine. Thanks [@&#8203;henningda](https://github.com/henningda).
- **`Gotenberg-Version` response header** ([#&#8203;1693](gotenberg/gotenberg#1693)). Set on every authenticated route, error responses included, and on webhook deliveries. It is not set on `401` responses or `/health` ([#&#8203;1694](gotenberg/gotenberg#1694)). Thanks [@&#8203;fragkakis](https://github.com/fragkakis).

##### Behavior Changes

- **The URL routes reject non-HTTP schemes.** `chrome://`, `devtools://`, `data:`, and any other scheme besides `http` and `https` now return `400`.
- **ExifTool ignores `~/.ExifTool_config`.** The metadata keys `j`, `addtagsfromfile`, and `alltagsfromfile` now return `400`. Prefix them with a group, for example `XMP:j`, to write a tag of that name.
- **The `XRECHNUNG` Factur-X profile embeds `xrechnung.xml`.** See the bug fix below.

##### Bug Fixes

- **Sporadic `502` on uploads behind HTTP/2 proxies** ([#&#8203;1112](gotenberg/gotenberg#1112)). Behind Cloud Run with an `h2c` port, the proxy sent large DATA frames, Go answered with a flood of WINDOW_UPDATE frames, and the proxy dropped the connection mid-upload. Gotenberg now advertises the 16 KiB HTTP/2 default frame size ([#&#8203;1700](gotenberg/gotenberg#1700)). Thanks [@&#8203;TessilimiTheo](https://github.com/TessilimiTheo) and [@&#8203;geoherna](https://github.com/geoherna).
- **No listener with absolute TLS paths** ([#&#8203;1690](gotenberg/gotenberg#1690)). Since 8.38.0, `--api-tls-cert-file` and `--api-tls-key-file` with absolute paths left Gotenberg running without accepting connections. Both paths work again, and a missing or unreadable file now fails the startup ([#&#8203;1691](gotenberg/gotenberg#1691)). Thanks [@&#8203;n-rodriguez](https://github.com/n-rodriguez).
- **Empty `stampSource` or `watermarkSource` returned `400`** ([#&#8203;1692](gotenberg/gotenberg#1692)). Since 8.36.0, a blank source failed the merge, split, Chromium, and LibreOffice routes. An empty source is skipped again. Thanks [@&#8203;APX403](https://github.com/APX403).
- **OIDC rejected `bearer` in lower case** ([#&#8203;1696](gotenberg/gotenberg#1696)). The Authorization scheme is now matched case-insensitively, as RFC 9110 requires. Thanks [@&#8203;MaxFreedomPollard](https://github.com/MaxFreedomPollard).
- **The `XRECHNUNG` Factur-X profile embedded `factur-x.xml`** ([#&#8203;1701](gotenberg/gotenberg#1701)). The spec requires `xrechnung.xml` for this profile, both as the embedded file and in `fx:DocumentFileName`. Other levels keep `factur-x.xml`. Thanks [@&#8203;nhh](https://github.com/nhh).

##### Chore

- Updated Chromium to `156.0.8078.47`.
- Updated pdfcpu to `v0.16.3` and bumped Go to `1.27.3`, which fix several HIGH CVEs in the Go standard library and `golang.org/x` modules ([#&#8203;1695](gotenberg/gotenberg#1695)). Thanks [@&#8203;sergeykad](https://github.com/sergeykad).
- Updated the AWS Lambda Web Adapter to `1.1.0`, which supports Lambda SnapStart ([#&#8203;1704](gotenberg/gotenberg#1704)). Thanks [@&#8203;michael-follmann](https://github.com/michael-follmann).
- Bumped golangci-lint to `v2.15.0`.
- Updated Go dependencies.

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/London)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODEuNyIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MS43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL21pbm9yIl19-->

Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/1021
eleboucher pushed a commit to eleboucher/homelab that referenced this pull request Oct 31, 2026
bot-owl @eleboucher
feat(container): update image docker.io/gotenberg/gotenberg (8.38.1 ➔…
fa7b139 
… 8.39.0) (#2479)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [docker.io/gotenberg/gotenberg](https://github.com/gotenberg/gotenberg) | minor | `8.38.1` → `8.39.0` |

---

### Release Notes

<details>
<summary>gotenberg/gotenberg (docker.io/gotenberg/gotenberg)</summary>

### [`v8.39.0`](https://github.com/gotenberg/gotenberg/releases/tag/v8.39.0): 8.39.0

[Compare Source](gotenberg/gotenberg@v8.38.1...v8.39.0)

##### Security Fixes ⚠️

- **Reject ExifTool's `j` option alias and stop loading ExifTool config files.** The metadata check blocked `json` but not its alias `j`. A metadata key could import a JSON file carrying a `HardLink` pseudo-tag, plant `~/.ExifTool_config`, and have the next ExifTool run execute it as Perl. The keys `j`, `addtagsfromfile`, and `alltagsfromfile` now return `400`, and Gotenberg always runs ExifTool with `-config ""`.
- **Accept only `http://` and `https://` URLs on the URL routes.** The default deny-list only covered `file://`, so `devtools://devtools/bundled/devtools_app.html` loaded Chromium's privileged DevTools page, and `waitForExpression` ran there with access to local files. `/forms/chromium/convert/url` and `/forms/chromium/screenshot/url` now return `400` for any other scheme.
- **Apply path and `wss://` deny rules to WebSocket handshakes.** The pinning proxy matched CONNECT tunnels against `https://host:port`, so a deny rule anchored on a path, such as `^https?://host/`, or on `wss://` refused the plain request but let the handshake through. The proxy now matches tunnels against each scheme's root URL, and a handshake whose full URL is denied fails the conversion with a generic `403`.
- **Drop the compromised eMudhra roots** ([#&#8203;1699](gotenberg/gotenberg#1699)). The images trusted `emSign ECC Root CA - G3` and `AAA Certificate Services`, whose intermediates have recoverable private keys. The OS bundle now comes from `ca-certificates` `20250419+deb13u1`, the Java trust store used by PDFtk drops both roots, and Chromium 156 rejects them. Thanks [@&#8203;hrueger](https://github.com/hrueger).

##### New Features

- **`failOnConsoleMessageTypes` for Chromium** ([#&#8203;1667](gotenberg/gotenberg#1667)). Fails the conversion with `409` when the page logs a console message of one of the given types (`log`, `debug`, `info`, `warning`, `error`, `assert`). The response lists the messages. Thanks [@&#8203;jschneider](https://github.com/jschneider).
- **PDF/A-4** ([#&#8203;1703](gotenberg/gotenberg#1703)). The `pdfa` form field now accepts `PDF/A-4` on every route that supports it, through the LibreOffice PDF engine. Thanks [@&#8203;henningda](https://github.com/henningda).
- **`Gotenberg-Version` response header** ([#&#8203;1693](gotenberg/gotenberg#1693)). Set on every authenticated route, error responses included, and on webhook deliveries. It is not set on `401` responses or `/health` ([#&#8203;1694](gotenberg/gotenberg#1694)). Thanks [@&#8203;fragkakis](https://github.com/fragkakis).

##### Behavior Changes

- **The URL routes reject non-HTTP schemes.** `chrome://`, `devtools://`, `data:`, and any other scheme besides `http` and `https` now return `400`.
- **ExifTool ignores `~/.ExifTool_config`.** The metadata keys `j`, `addtagsfromfile`, and `alltagsfromfile` now return `400`. Prefix them with a group, for example `XMP:j`, to write a tag of that name.
- **The `XRECHNUNG` Factur-X profile embeds `xrechnung.xml`.** See the bug fix below.

##### Bug Fixes

- **Sporadic `502` on uploads behind HTTP/2 proxies** ([#&#8203;1112](gotenberg/gotenberg#1112)). Behind Cloud Run with an `h2c` port, the proxy sent large DATA frames, Go answered with a flood of WINDOW_UPDATE frames, and the proxy dropped the connection mid-upload. Gotenberg now advertises the 16 KiB HTTP/2 default frame size ([#&#8203;1700](gotenberg/gotenberg#1700)). Thanks [@&#8203;TessilimiTheo](https://github.com/TessilimiTheo) and [@&#8203;geoherna](https://github.com/geoherna).
- **No listener with absolute TLS paths** ([#&#8203;1690](gotenberg/gotenberg#1690)). Since 8.38.0, `--api-tls-cert-file` and `--api-tls-key-file` with absolute paths left Gotenberg running without accepting connections. Both paths work again, and a missing or unreadable file now fails the startup ([#&#8203;1691](gotenberg/gotenberg#1691)). Thanks [@&#8203;n-rodriguez](https://github.com/n-rodriguez).
- **Empty `stampSource` or `watermarkSource` returned `400`** ([#&#8203;1692](gotenberg/gotenberg#1692)). Since 8.36.0, a blank source failed the merge, split, Chromium, and LibreOffice routes. An empty source is skipped again. Thanks [@&#8203;APX403](https://github.com/APX403).
- **OIDC rejected `bearer` in lower case** ([#&#8203;1696](gotenberg/gotenberg#1696)). The Authorization scheme is now matched case-insensitively, as RFC 9110 requires. Thanks [@&#8203;MaxFreedomPollard](https://github.com/MaxFreedomPollard).
- **The `XRECHNUNG` Factur-X profile embedded `factur-x.xml`** ([#&#8203;1701](gotenberg/gotenberg#1701)). The spec requires `xrechnung.xml` for this profile, both as the embedded file and in `fx:DocumentFileName`. Other levels keep `factur-x.xml`. Thanks [@&#8203;nhh](https://github.com/nhh).

##### Chore

- Updated Chromium to `156.0.8078.47`.
- Updated pdfcpu to `v0.16.3` and bumped Go to `1.27.3`, which fix several HIGH CVEs in the Go standard library and `golang.org/x` modules ([#&#8203;1695](gotenberg/gotenberg#1695)). Thanks [@&#8203;sergeykad](https://github.com/sergeykad).
- Updated the AWS Lambda Web Adapter to `1.1.0`, which supports Lambda SnapStart ([#&#8203;1704](gotenberg/gotenberg#1704)). Thanks [@&#8203;michael-follmann](https://github.com/michael-follmann).
- Bumped golangci-lint to `v2.15.0`.
- Updated Go dependencies.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODEuOSIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MS45IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/2479
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

bug Something isn't working

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@MaxFreedomPollard @gulien