Repository: Wulf/create-rust-app (language: rust)

Issue:
Issue with how JWT Auth is handled (out of compliance with RFC 6750)
According to [RFC 6750](https://www.rfc-editor.org/rfc/rfc6750.html#page-5), the `Authorization` header of a request should contain ` Bearer ` before the actual token, for example: `Authorization: Bearer eyJ...`, but that will return a 401 error in the current implementation.

Currently, it works when the `Authorization` header content isn't prefixed by `Bearer `

I'll create a PR to fix this soon, but will hold off on merging it (without review) as it is technically a breaking change


Discussion / hints:

Fix patch:
diff --git a/create-rust-app/src/auth/extractors/auth_actixweb.rs b/create-rust-app/src/auth/extractors/auth_actixweb.rs
index a551569a..bcba185e 100644
--- a/create-rust-app/src/auth/extractors/auth_actixweb.rs
+++ b/create-rust-app/src/auth/extractors/auth_actixweb.rs
@@ -100,8 +100,14 @@ impl FromRequest for Auth {
 
         let access_token_str = auth_header_opt.unwrap().to_str().unwrap_or("");
 
+        if !access_token_str.starts_with("Bearer ") { 
+            return ready(Err(AuthError {
+                reason: "Invalid authorization header".to_string(),
+            }));
+        }
+
         let access_token = decode::<AccessTokenClaims>(
-            access_token_str,
+            access_token_str.trim_start_matches("Bearer "),
             &DecodingKey::from_secret(std::env::var("SECRET_KEY").unwrap().as_ref()),
             &Validation::default(),
         );
diff --git a/create-rust-app/src/auth/extractors/auth_poem.rs b/create-rust-app/src/auth/extractors/auth_poem.rs
index 776fd813..fd783a9f 100644
--- a/create-rust-app/src/auth/extractors/auth_poem.rs
+++ b/create-rust-app/src/auth/extractors/auth_poem.rs
@@ -70,8 +70,15 @@ impl<'a> FromRequest<'a> for Auth {
 
         let access_token_str = auth_header_opt.unwrap().to_str().unwrap_or("");
 
+        if !access_token_str.starts_with("Bearer ") { 
+            return Err(Error::from_string(
+                "Invalid authorization header",
+                StatusCode::UNAUTHORIZED,
+            ));
+        }
+
         let access_token = decode::<AccessTokenClaims>(
-            access_token_str,
+            access_token_str.trim_start_matches("Bearer "),
             &DecodingKey::from_secret(std::env::var("SECRET_KEY").unwrap().as_ref()),
             &Validation::default(),
         );
diff --git a/create-rust-app_cli/src/qsync/hook.rs b/create-rust-app_cli/src/qsync/hook.rs
index af13c798..4ccecc59 100644
--- a/create-rust-app_cli/src/qsync/hook.rs
+++ b/create-rust-app_cli/src/qsync/hook.rs
@@ -240,7 +240,7 @@ impl Hook {
 }}"#,
                 variables = self.build_vars_string(),
                 authorization_header = if self.uses_auth {
-                    "'Authorization': `${auth.accessToken}`,\n              "
+                    "'Authorization': `Bearer ${auth.accessToken}`,\n              "
                 } else {
                     ""
                 },
@@ -277,7 +277,7 @@ impl Hook {
 }}"#,
                 variables = self.build_vars_string(),
                 authorization_header = if self.uses_auth {
-                    "'Authorization': `${auth.accessToken}`,\n              "
+                    "'Authorization': `Bearer ${auth.accessToken}`,\n              "
                 } else {
                     ""
                 },


Test patch: