fix: case-insensitive Bearer token parsing in auth header

2026-05-30 12:55:02 +00:00
parent c5375b8a77
commit d2c2962ad1
1 changed files with 1 additions and 1 deletions
@@ -939,7 +939,7 @@ local function _check_auth(self, conn)
    if not self._auth_token then return true end
    if conn.method == "OPTIONS" then return true end
    local auth = conn.headers["authorization"] or ""
-    local token = auth:match("^Bearer%s+(.+)$")
+    local token = auth:match("^[Bb]earer%s+(.+)$")
    return token == self._auth_token
 end