fix: C3 case-insensitive Bearer prefix + S1 MCP asyncio.Lock (closes 2 xfail)

2026-07-06 07:10:35 +02:00
parent 2672bd86e6
commit 347ccb0c68
2 changed files with 18 additions and 10 deletions
@@ -15,7 +15,12 @@ async def get_current_user(
    if not authorization:
        raise HTTPException(status_code=401, detail="Missing Authorization header")

-    token = authorization.replace("Bearer ", "").strip()
+    # Case-insensitive Bearer prefix handling (C3)
+    auth_value = authorization.strip()
+    if auth_value.lower().startswith("bearer "):
+        token = auth_value[7:].strip()
+    else:
+        token = auth_value

    # Static-Auth-Token als Master-Key (für Setup/Bootstrap)
    if token == settings.AUTH_TOKEN: