Skip to content

Commit 1dc33e8

Browse files
committed
fix: make Authorization header check case-insensitive
- Fix issue #1043 where custom Authorization headers were checked case-sensitively - HTTP headers should be case-insensitive according to RFC standards - Replace exact key match with case-insensitive check using Object.keys().some() - This allows headers like 'authorization', 'Authorization', 'AUTHORIZATION' to work correctly
1 parent 7876a24 commit 1dc33e8

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

src/SupabaseClient.ts

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -315,7 +315,9 @@ export default class SupabaseClient<
315315
fetch,
316316
// auth checks if there is a custom authorizaiton header using this flag
317317
// so it knows whether to return an error when getUser is called with no session
318-
hasCustomAuthorizationHeader: 'Authorization' in this.headers,
318+
hasCustomAuthorizationHeader: Object.keys(this.headers).some(
319+
(key) => key.toLowerCase() === 'authorization'
320+
),
319321
})
320322
}
321323

0 commit comments

Comments
 (0)