From 107ec6710559b0f24e0f243cd9e1384ac1133e27 Mon Sep 17 00:00:00 2001
From: kento2 <kento@placeq.com>
Date: Tue, 8 Sep 2026 19:13:17 +0200
Subject: [PATCH] make header field names case insensitive

---
 parse_token.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/parse_token.c b/parse_token.c
index 24b6fcb..fb344cc 100644
--- a/parse_token.c
+++ b/parse_token.c
@@ -2,11 +2,21 @@
 #include <libowfat/buffer.h>
 #include <libowfat/errmsg.h>
 #include <libowfat/str.h>
+#include <ctype.h>
 
-#define AUTH_HEADER "Authorization: Bearer " 
+#define AUTH_HEADER "authorization: bearer " 
 #define AUTH_HEADER_LEN str_len(AUTH_HEADER) 
 
-// TODO make case insensitive according to https://www.rfc-editor.org/info/rfc7230/#section-3.2
+static int startswithlower(stralloc *sa, char *prefix, size_t prefixlen)
+{
+  size_t i;
+  if (sa->len < prefixlen) return 0;
+  for (i=0;i<prefixlen;i++)
+    if (tolower(sa->s[i]) != prefix[i])
+      return 0;
+  return 1;
+}
+
 int parse_token(buffer *b, stralloc *result)
 {
   stralloc line;
@@ -17,7 +27,9 @@ int parse_token(buffer *b, stralloc *result)
     if (r==0) break;
     if (r<0) { carpsys("read line"); goto err; } 
 
-    if (stralloc_starts(&line,AUTH_HEADER)) {
+    /* header field names are case-sensitive
+     * https://www.rfc-editor.org/info/rfc7230/#section-3.2 */
+    if (startswithlower(&line,AUTH_HEADER,AUTH_HEADER_LEN)) {
       stralloc_chomp(&line); 
       if (!stralloc_copyb(result, line.s+AUTH_HEADER_LEN,
             line.len-AUTH_HEADER_LEN)