Repository: rails/rails
File: actionpack/lib/action_dispatch/http/request.rb (Ruby)

Code before:
        form_pairs
      elsif form_vars = get_header("rack.request.form_vars")
        # URL-encoded
        ActionDispatch::QueryParser.each_pair(form_vars)
      elsif rack_post && !rack_post.empty?
        # It was multipart, but Rack did not preserve a pair list
        # (probably too old). Flat parameter list is not available.
        nil
      else
        # No request body, or not a format Rack knows
        []
      end
    end

    # Returns the authorization header regardless of whether it was specified
    # directly or through one of the proxy alternatives.
    def authorization
      get_header("HTTP_AUTHORIZATION")   ||
      get_header("X-HTTP_AUTHORIZATION") ||
      get_header("X_HTTP_AUTHORIZATION") ||
      get_header("REDIRECT_X_HTTP_AUTHORIZATION")
    end

    # True if the request came from localhost, 127.0.0.1, or ::1.
    def local?
      LOCALHOST.match?(remote_addr) && LOCALHOST.match?(remote_ip)
    end

    def request_parameters=(params)
      raise if params.nil?
      set_header("action_dispatch.request.request_parameters", params)
    end

    def logger
      get_header("action_dispatch.logger")
    end

    def commit_flash
    end

    def inspect # :nodoc:
      "#<#{self.class.name} #{method} #{original_url.dump} for #{remote_ip}>"
    end

    def reset_csrf_token
      controller_instance.reset_csrf_token(self) if controller_instance.respond_to?(:reset_csrf_token)
    end

    def commit_csrf_token
      controller_instance.commit_csrf_token(self) if controller_instance.respond_to?(:commit_csrf_token)
    end

Review comment (security):
Would it make sense to support both Token and Bearer prefixes here?

Currently, [ActionController::HttpAuthentication::Token](https://github.com/rails/rails/blob/0cfd49f401f12ef5d32f811f93150c6cbf92c1b3/actionpack/lib/action_controller/metal/http_authentication.rb#L427) uses the following regex: 

```ruby
TOKEN_REGEX = /^(Token|Bearer)\s+/
```

Code after:
        form_pairs
      elsif form_vars = get_header("rack.request.form_vars")
        # URL-encoded
        ActionDispatch::QueryParser.each_pair(form_vars)
      elsif rack_post && !rack_post.empty?
        # It was multipart, but Rack did not preserve a pair list
        # (probably too old). Flat parameter list is not available.
        nil
      else
        # No request body, or not a format Rack knows
        []
      end
    end

    # Returns the authorization header regardless of whether it was specified
    # directly or through one of the proxy alternatives.
    def authorization
      get_header("HTTP_AUTHORIZATION")   ||
      get_header("X-HTTP_AUTHORIZATION") ||
      get_header("X_HTTP_AUTHORIZATION") ||
      get_header("REDIRECT_X_HTTP_AUTHORIZATION")
    end

    # Returns the bearer token embedded in the authorization header or nil if missing.
    def bearer_token
      authorization.to_s[/\ABearer (.+)\z/, 1]
    end

    # True if the request came from localhost, 127.0.0.1, or ::1.
    def local?
      LOCALHOST.match?(remote_addr) && LOCALHOST.match?(remote_ip)
    end

    def request_parameters=(params)
      raise if params.nil?
      set_header("action_dispatch.request.request_parameters", params)
    end

    def logger
      get_header("action_dispatch.logger")
    end

    def commit_flash
    end

    def inspect # :nodoc:
      "#<#{self.class.name} #{method} #{original_url.dump} for #{remote_ip}>"
    end

    def reset_csrf_token
      controller_instance.reset_csrf_token(self) if controller_instance.respond_to?(:reset_csrf_token)