(arrow-go) branch main updated: fix(flight): accept case-insensitive authorization schemes (#1071)

[zeroshade]

This is an automated email from the ASF dual-hosted git repository.

zeroshade pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/arrow-go.git


The following commit(s) were added to refs/heads/main by this push:
     new 382343f6 fix(flight): accept case-insensitive authorization schemes 
(#1071)
382343f6 is described below

commit 382343f638ea95aa15bd242f1f5727985c9fe012
Author: Minh Vu <vuhoangmin...@gmail.com>
AuthorDate: Wed Aug 5 19:58:48 2026 +0200

    fix(flight): accept case-insensitive authorization schemes (#1071)
    
    ## Problem
    
    Flight authentication compared the `Basic` and `Bearer` authorization
    schemes case-sensitively, even though HTTP authentication scheme names
    are case-insensitive. Valid clients using forms such as `bearer` were
    rejected.
    
    ## Change
    
    Use `strings.EqualFold` for scheme matching in both Basic and Bearer
    authentication paths. Credential bytes remain untouched and
    case-sensitive.
    
    ## Coverage
    
    The regression test sends a lowercase Bearer scheme through the Flight
    server and verifies successful authentication.
    
    ## Validation
    
    `go test ./arrow/flight`
---
 arrow/flight/basic_auth_flight_test.go | 11 +++++++++++
 arrow/flight/server_auth.go            |  6 +++---
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/arrow/flight/basic_auth_flight_test.go 
b/arrow/flight/basic_auth_flight_test.go
index 242228b8..f4f70d9c 100644
--- a/arrow/flight/basic_auth_flight_test.go
+++ b/arrow/flight/basic_auth_flight_test.go
@@ -173,6 +173,17 @@ func TestErrorAuths(t *testing.T) {
                        t.Fatalf("unexpected schema: got %q, want %q", got, 
want)
                }
        })
+
+       t.Run("lowercase bearer scheme", func(t *testing.T) {
+               ctx := metadata.NewOutgoingContext(context.Background(), 
metadata.Pairs("authorization", "bearer "+validBearer))
+               result, err := client.GetSchema(ctx, &flight.FlightDescriptor{})
+               if err != nil {
+                       t.Fatal(err)
+               }
+               if got, want := string(result.Schema), "carebears"; got != want 
{
+                       t.Fatalf("unexpected schema: got %q, want %q", got, 
want)
+               }
+       })
 }
 
 func TestBasicAuthHelpers(t *testing.T) {
diff --git a/arrow/flight/server_auth.go b/arrow/flight/server_auth.go
index ab1ee06d..d61fa1dc 100644
--- a/arrow/flight/server_auth.go
+++ b/arrow/flight/server_auth.go
@@ -160,7 +160,7 @@ func createServerBearerTokenUnaryInterceptor(validator 
BasicAuthValidator) grpc.
                        }
                }
 
-               if scheme != bearerTokenPrefix || credential == "" {
+               if !strings.EqualFold(scheme, bearerTokenPrefix) || credential 
== "" {
                        return nil, status.Error(codes.Unauthenticated, "must 
authenticate first")
                }
 
@@ -191,7 +191,7 @@ func createServerBearerTokenStreamInterceptor(validator 
BasicAuthValidator) grpc
                }
 
                if strings.HasSuffix(info.FullMethod, "/Handshake") {
-                       if scheme == basicAuthPrefix {
+                       if strings.EqualFold(scheme, basicAuthPrefix) {
                                val, err := 
base64.RawStdEncoding.DecodeString(credential)
                                if err != nil {
                                        val, err = 
base64.StdEncoding.DecodeString(credential)
@@ -217,7 +217,7 @@ func createServerBearerTokenStreamInterceptor(validator 
BasicAuthValidator) grpc
                        return status.Errorf(codes.Unauthenticated, "only Basic 
Auth implemented")
                }
 
-               if scheme == bearerTokenPrefix {
+               if strings.EqualFold(scheme, bearerTokenPrefix) {
                        identity, err := validator.IsValid(credential)
                        if err != nil {
                                return err