Function RequireBearerToken

auth/auth.go:69–97

RequireBearerToken returns a piece of middleware that verifies a bearer token using the verifier. If verification succeeds, the [TokenInfo] is added to the request's context and the request proceeds. If verification fails, the request fails with a 401 Unauthenticated, and the WWW-Authenticate header

(verifier TokenVerifier, opts *RequireBearerTokenOptions)

//
// [protected resource metadata]: https://datatracker.ietf.org/doc/rfc9728
func RequireBearerToken(verifier TokenVerifier, opts *RequireBearerTokenOptions) func(http.Handler) http.Handler {
	// Based on typescript-sdk/src/server/auth/middleware/bearerAuth.ts.

	return func(handler http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			tokenInfo, errmsg, code := verify(r, verifier, opts)
			if code != 0 {
				if code == http.StatusUnauthorized || code == http.StatusForbidden {
					if opts != nil {
						var params []string
						if opts.ResourceMetadataURL != "" {
							params = append(params, fmt.Sprintf("resource_metadata=%q", opts.ResourceMetadataURL))
						}
						if len(opts.Scopes) > 0 {
							params = append(params, fmt.Sprintf("scope=%q", strings.Join(opts.Scopes, " ")))
						}
						if len(params) > 0 {
							w.Header().Add("WWW-Authenticate", "Bearer "+strings.Join(params, ", "))
						}
					}
				}
				http.Error(w, errmsg, code)
				return
			}
			r = r.WithContext(context.WithValue(r.Context(), tokenInfoKey{}, tokenInfo))
			handler.ServeHTTP(w, r)
		})
	}
}

func verify(req *http.Request, verifier TokenVerifier, opts *RequireBearerTokenOptions) (_ *TokenInfo, errmsg string, code int) {
	// Extract bearer token.