A quick way to validate token string#302
Conversation
|
Wow, to be honest I would not have thought that this is an issue. I wonder why the implementation of HasPrefix does not abort searching the string after n bytes. I will also look at this in the coming days if we have sufficient tests. Update: Nevermind, obviously the ToLower was the problem here |
Hundreds of projects use this library for authentication, so I want to improve the performance of it as much as possible :D |
|
LGTM. Sorry for the long delay, I think we can ignore the 0.03 % coverage loss cc @mfridman |
| // The usual convention is for "Bearer" to be title-cased. However, there's no | ||
| // strict rule around this, and it's best to follow the robustness principle here. | ||
| if tokenHeader == "" || !strings.HasPrefix(strings.ToLower(tokenHeader), "bearer ") { | ||
| if len(tokenHeader) < 7 || !strings.HasPrefix(strings.ToLower(tokenHeader[:7]), "bearer ") { |
There was a problem hiding this comment.
This is late and a nitpick, but HasPrefix also slices the front. Is it faster to drop the call completely?
| if len(tokenHeader) < 7 || !strings.HasPrefix(strings.ToLower(tokenHeader[:7]), "bearer ") { | |
| if len(tokenHeader) < 7 || strings.ToLower(tokenHeader[:7]) != "bearer " { |
There was a problem hiding this comment.
We adjusted it in a follow-up PR: https://github.com/golang-jwt/jwt/pull/329/files
[](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/golang-jwt/jwt/v5](https://togithub.com/golang-jwt/jwt) | require | minor | `v5.0.0` -> `v5.1.0` | | golang.org/x/crypto | require | minor | `v0.14.0` -> `v0.15.0` | | golang.org/x/net | require | minor | `v0.17.0` -> `v0.18.0` | | golang.org/x/oauth2 | require | minor | `v0.13.0` -> `v0.14.0` | | golang.org/x/term | require | minor | `v0.13.0` -> `v0.14.0` | --- ### Release Notes <details> <summary>golang-jwt/jwt (github.com/golang-jwt/jwt/v5)</summary> ### [`v5.1.0`](https://togithub.com/golang-jwt/jwt/releases/tag/v5.1.0) [Compare Source](https://togithub.com/golang-jwt/jwt/compare/v5.0.0...v5.1.0) #### What's Changed - Using jwt's native `ErrInvalidType` instead of `json.UnsupportedTypeError` by [@​oxisto](https://togithub.com/oxisto) in [https://github.com/golang-jwt/jwt/pull/316](https://togithub.com/golang-jwt/jwt/pull/316) - Fix typos in comments and test names by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/317](https://togithub.com/golang-jwt/jwt/pull/317) - Format: add whitespaces, remove empty lines by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/319](https://togithub.com/golang-jwt/jwt/pull/319) - Refactor example: use io.ReadAll instead of io.Copy by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/320](https://togithub.com/golang-jwt/jwt/pull/320) - Refactor code by using switch instead of if-else by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/318](https://togithub.com/golang-jwt/jwt/pull/318) - A quick way to validate token string by [@​dcalsky](https://togithub.com/dcalsky) in [https://github.com/golang-jwt/jwt/pull/302](https://togithub.com/golang-jwt/jwt/pull/302) - Refactor: remove unnecessary \[]byte conversion to string by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/330](https://togithub.com/golang-jwt/jwt/pull/330) - Refactor: compare strings with strings.EqualFold by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/329](https://togithub.com/golang-jwt/jwt/pull/329) - Avoid use of json.NewDecoder by [@​craigpastro](https://togithub.com/craigpastro) in [https://github.com/golang-jwt/jwt/pull/313](https://togithub.com/golang-jwt/jwt/pull/313) - Update ParseUnverified godoc by [@​duhaesbaert](https://togithub.com/duhaesbaert) in [https://github.com/golang-jwt/jwt/pull/341](https://togithub.com/golang-jwt/jwt/pull/341) - Update ci workflows (add go1.21) by [@​mfridman](https://togithub.com/mfridman) in [https://github.com/golang-jwt/jwt/pull/345](https://togithub.com/golang-jwt/jwt/pull/345) - Bump actions/checkout from 3 to 4 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/golang-jwt/jwt/pull/346](https://togithub.com/golang-jwt/jwt/pull/346) - Key rotation with VerificationKeySet by [@​mfridman](https://togithub.com/mfridman) in [https://github.com/golang-jwt/jwt/pull/344](https://togithub.com/golang-jwt/jwt/pull/344) - Add explicit ClaimsValidator implementation check for custom claims by [@​epelc](https://togithub.com/epelc) in [https://github.com/golang-jwt/jwt/pull/343](https://togithub.com/golang-jwt/jwt/pull/343) - feat: allow making exp claim required by [@​tareksha](https://togithub.com/tareksha) in [https://github.com/golang-jwt/jwt/pull/351](https://togithub.com/golang-jwt/jwt/pull/351) - Add error handling to examples by [@​craigpastro](https://togithub.com/craigpastro) in [https://github.com/golang-jwt/jwt/pull/312](https://togithub.com/golang-jwt/jwt/pull/312) #### New Contributors - [@​alexandear](https://togithub.com/alexandear) made their first contribution in [https://github.com/golang-jwt/jwt/pull/317](https://togithub.com/golang-jwt/jwt/pull/317) - [@​dcalsky](https://togithub.com/dcalsky) made their first contribution in [https://github.com/golang-jwt/jwt/pull/302](https://togithub.com/golang-jwt/jwt/pull/302) - [@​craigpastro](https://togithub.com/craigpastro) made their first contribution in [https://github.com/golang-jwt/jwt/pull/313](https://togithub.com/golang-jwt/jwt/pull/313) - [@​duhaesbaert](https://togithub.com/duhaesbaert) made their first contribution in [https://github.com/golang-jwt/jwt/pull/341](https://togithub.com/golang-jwt/jwt/pull/341) - [@​epelc](https://togithub.com/epelc) made their first contribution in [https://github.com/golang-jwt/jwt/pull/343](https://togithub.com/golang-jwt/jwt/pull/343) - [@​tareksha](https://togithub.com/tareksha) made their first contribution in [https://github.com/golang-jwt/jwt/pull/351](https://togithub.com/golang-jwt/jwt/pull/351) **Full Changelog**: golang-jwt/jwt@v5.0.0...v5.1.0 </details> --- ### Configuration π **Schedule**: Branch creation - "before 4am" (UTC), Automerge - "before 4am" (UTC). π¦ **Automerge**: Enabled. β» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. π» **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/woodpecker-ci/woodpecker). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40Ni4wIiwidXBkYXRlZEluVmVyIjoiMzcuNDYuMCIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
[](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/golang-jwt/jwt/v5](https://togithub.com/golang-jwt/jwt) | require | minor | `v5.0.0` -> `v5.1.0` | --- ### Release Notes <details> <summary>golang-jwt/jwt (github.com/golang-jwt/jwt/v5)</summary> ### [`v5.1.0`](https://togithub.com/golang-jwt/jwt/releases/tag/v5.1.0) [Compare Source](https://togithub.com/golang-jwt/jwt/compare/v5.0.0...v5.1.0) #### What's Changed - Using jwt's native `ErrInvalidType` instead of `json.UnsupportedTypeError` by [@​oxisto](https://togithub.com/oxisto) in [https://github.com/golang-jwt/jwt/pull/316](https://togithub.com/golang-jwt/jwt/pull/316) - Fix typos in comments and test names by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/317](https://togithub.com/golang-jwt/jwt/pull/317) - Format: add whitespaces, remove empty lines by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/319](https://togithub.com/golang-jwt/jwt/pull/319) - Refactor example: use io.ReadAll instead of io.Copy by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/320](https://togithub.com/golang-jwt/jwt/pull/320) - Refactor code by using switch instead of if-else by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/318](https://togithub.com/golang-jwt/jwt/pull/318) - A quick way to validate token string by [@​dcalsky](https://togithub.com/dcalsky) in [https://github.com/golang-jwt/jwt/pull/302](https://togithub.com/golang-jwt/jwt/pull/302) - Refactor: remove unnecessary \[]byte conversion to string by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/330](https://togithub.com/golang-jwt/jwt/pull/330) - Refactor: compare strings with strings.EqualFold by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/329](https://togithub.com/golang-jwt/jwt/pull/329) - Avoid use of json.NewDecoder by [@​craigpastro](https://togithub.com/craigpastro) in [https://github.com/golang-jwt/jwt/pull/313](https://togithub.com/golang-jwt/jwt/pull/313) - Update ParseUnverified godoc by [@​duhaesbaert](https://togithub.com/duhaesbaert) in [https://github.com/golang-jwt/jwt/pull/341](https://togithub.com/golang-jwt/jwt/pull/341) - Update ci workflows (add go1.21) by [@​mfridman](https://togithub.com/mfridman) in [https://github.com/golang-jwt/jwt/pull/345](https://togithub.com/golang-jwt/jwt/pull/345) - Bump actions/checkout from 3 to 4 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/golang-jwt/jwt/pull/346](https://togithub.com/golang-jwt/jwt/pull/346) - Key rotation with VerificationKeySet by [@​mfridman](https://togithub.com/mfridman) in [https://github.com/golang-jwt/jwt/pull/344](https://togithub.com/golang-jwt/jwt/pull/344) - Add explicit ClaimsValidator implementation check for custom claims by [@​epelc](https://togithub.com/epelc) in [https://github.com/golang-jwt/jwt/pull/343](https://togithub.com/golang-jwt/jwt/pull/343) - feat: allow making exp claim required by [@​tareksha](https://togithub.com/tareksha) in [https://github.com/golang-jwt/jwt/pull/351](https://togithub.com/golang-jwt/jwt/pull/351) - Add error handling to examples by [@​craigpastro](https://togithub.com/craigpastro) in [https://github.com/golang-jwt/jwt/pull/312](https://togithub.com/golang-jwt/jwt/pull/312) #### New Contributors - [@​alexandear](https://togithub.com/alexandear) made their first contribution in [https://github.com/golang-jwt/jwt/pull/317](https://togithub.com/golang-jwt/jwt/pull/317) - [@​dcalsky](https://togithub.com/dcalsky) made their first contribution in [https://github.com/golang-jwt/jwt/pull/302](https://togithub.com/golang-jwt/jwt/pull/302) - [@​craigpastro](https://togithub.com/craigpastro) made their first contribution in [https://github.com/golang-jwt/jwt/pull/313](https://togithub.com/golang-jwt/jwt/pull/313) - [@​duhaesbaert](https://togithub.com/duhaesbaert) made their first contribution in [https://github.com/golang-jwt/jwt/pull/341](https://togithub.com/golang-jwt/jwt/pull/341) - [@​epelc](https://togithub.com/epelc) made their first contribution in [https://github.com/golang-jwt/jwt/pull/343](https://togithub.com/golang-jwt/jwt/pull/343) - [@​tareksha](https://togithub.com/tareksha) made their first contribution in [https://github.com/golang-jwt/jwt/pull/351](https://togithub.com/golang-jwt/jwt/pull/351) **Full Changelog**: golang-jwt/jwt@v5.0.0...v5.1.0 </details> --- ### Configuration π **Schedule**: Branch creation - "before 6am on Monday" in timezone Europe/Paris, Automerge - At any time (no schedule defined). π¦ **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. π **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/cozy/cozy-stack). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy41OS44IiwidXBkYXRlZEluVmVyIjoiMzcuNTkuOCIsInRhcmdldEJyYW5jaCI6Im1hc3RlciJ9-->
[](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [github.com/golang-jwt/jwt/v5](https://togithub.com/golang-jwt/jwt) | `v5.0.0` -> `v5.2.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>golang-jwt/jwt (github.com/golang-jwt/jwt/v5)</summary> ### [`v5.2.1`](https://togithub.com/golang-jwt/jwt/releases/tag/v5.2.1) [Compare Source](https://togithub.com/golang-jwt/jwt/compare/v5.2.0...v5.2.1) #### What's Changed - chore: remove unnecessary conversions from tests by [@​estensen](https://togithub.com/estensen) in [https://github.com/golang-jwt/jwt/pull/370](https://togithub.com/golang-jwt/jwt/pull/370) - Trivial: Typo fix for ECDSA error message by [@​tjs-cinemo](https://togithub.com/tjs-cinemo) in [https://github.com/golang-jwt/jwt/pull/373](https://togithub.com/golang-jwt/jwt/pull/373) - Fix incorrect error return by [@​ss49919201](https://togithub.com/ss49919201) in [https://github.com/golang-jwt/jwt/pull/371](https://togithub.com/golang-jwt/jwt/pull/371) #### New Contributors - [@​tjs-cinemo](https://togithub.com/tjs-cinemo) made their first contribution in [https://github.com/golang-jwt/jwt/pull/373](https://togithub.com/golang-jwt/jwt/pull/373) - [@​ss49919201](https://togithub.com/ss49919201) made their first contribution in [https://github.com/golang-jwt/jwt/pull/371](https://togithub.com/golang-jwt/jwt/pull/371) **Full Changelog**: golang-jwt/jwt@v5.2.0...v5.2.1 ### [`v5.2.0`](https://togithub.com/golang-jwt/jwt/releases/tag/v5.2.0) [Compare Source](https://togithub.com/golang-jwt/jwt/compare/v5.1.0...v5.2.0) #### What's Changed - Exported `NewValidator` by [@​oxisto](https://togithub.com/oxisto) in [https://github.com/golang-jwt/jwt/pull/349](https://togithub.com/golang-jwt/jwt/pull/349) - Improve ErrInvalidKeyType error messages by [@​Laurin-Notemann](https://togithub.com/Laurin-Notemann) in [https://github.com/golang-jwt/jwt/pull/361](https://togithub.com/golang-jwt/jwt/pull/361) - Update MIGRATION_GUIDE.md by [@​jbarham](https://togithub.com/jbarham) in [https://github.com/golang-jwt/jwt/pull/363](https://togithub.com/golang-jwt/jwt/pull/363) #### New Contributors - [@​Laurin-Notemann](https://togithub.com/Laurin-Notemann) made their first contribution in [https://github.com/golang-jwt/jwt/pull/361](https://togithub.com/golang-jwt/jwt/pull/361) - [@​jbarham](https://togithub.com/jbarham) made their first contribution in [https://github.com/golang-jwt/jwt/pull/363](https://togithub.com/golang-jwt/jwt/pull/363) **Full Changelog**: golang-jwt/jwt@v5.1.0...v5.2.0 ### [`v5.1.0`](https://togithub.com/golang-jwt/jwt/releases/tag/v5.1.0) [Compare Source](https://togithub.com/golang-jwt/jwt/compare/v5.0.0...v5.1.0) #### What's Changed - Using jwt's native `ErrInvalidType` instead of `json.UnsupportedTypeError` by [@​oxisto](https://togithub.com/oxisto) in [https://github.com/golang-jwt/jwt/pull/316](https://togithub.com/golang-jwt/jwt/pull/316) - Fix typos in comments and test names by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/317](https://togithub.com/golang-jwt/jwt/pull/317) - Format: add whitespaces, remove empty lines by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/319](https://togithub.com/golang-jwt/jwt/pull/319) - Refactor example: use io.ReadAll instead of io.Copy by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/320](https://togithub.com/golang-jwt/jwt/pull/320) - Refactor code by using switch instead of if-else by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/318](https://togithub.com/golang-jwt/jwt/pull/318) - A quick way to validate token string by [@​dcalsky](https://togithub.com/dcalsky) in [https://github.com/golang-jwt/jwt/pull/302](https://togithub.com/golang-jwt/jwt/pull/302) - Refactor: remove unnecessary \[]byte conversion to string by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/330](https://togithub.com/golang-jwt/jwt/pull/330) - Refactor: compare strings with strings.EqualFold by [@​alexandear](https://togithub.com/alexandear) in [https://github.com/golang-jwt/jwt/pull/329](https://togithub.com/golang-jwt/jwt/pull/329) - Avoid use of json.NewDecoder by [@​craigpastro](https://togithub.com/craigpastro) in [https://github.com/golang-jwt/jwt/pull/313](https://togithub.com/golang-jwt/jwt/pull/313) - Update ParseUnverified godoc by [@​duhaesbaert](https://togithub.com/duhaesbaert) in [https://github.com/golang-jwt/jwt/pull/341](https://togithub.com/golang-jwt/jwt/pull/341) - Update ci workflows (add go1.21) by [@​mfridman](https://togithub.com/mfridman) in [https://github.com/golang-jwt/jwt/pull/345](https://togithub.com/golang-jwt/jwt/pull/345) - Bump actions/checkout from 3 to 4 by [@​dependabot](https://togithub.com/dependabot) in [https://github.com/golang-jwt/jwt/pull/346](https://togithub.com/golang-jwt/jwt/pull/346) - Key rotation with VerificationKeySet by [@​mfridman](https://togithub.com/mfridman) in [https://github.com/golang-jwt/jwt/pull/344](https://togithub.com/golang-jwt/jwt/pull/344) - Add explicit ClaimsValidator implementation check for custom claims by [@​epelc](https://togithub.com/epelc) in [https://github.com/golang-jwt/jwt/pull/343](https://togithub.com/golang-jwt/jwt/pull/343) - feat: allow making exp claim required by [@​tareksha](https://togithub.com/tareksha) in [https://github.com/golang-jwt/jwt/pull/351](https://togithub.com/golang-jwt/jwt/pull/351) - Add error handling to examples by [@​craigpastro](https://togithub.com/craigpastro) in [https://github.com/golang-jwt/jwt/pull/312](https://togithub.com/golang-jwt/jwt/pull/312) #### New Contributors - [@​alexandear](https://togithub.com/alexandear) made their first contribution in [https://github.com/golang-jwt/jwt/pull/317](https://togithub.com/golang-jwt/jwt/pull/317) - [@​dcalsky](https://togithub.com/dcalsky) made their first contribution in [https://github.com/golang-jwt/jwt/pull/302](https://togithub.com/golang-jwt/jwt/pull/302) - [@​craigpastro](https://togithub.com/craigpastro) made their first contribution in [https://github.com/golang-jwt/jwt/pull/313](https://togithub.com/golang-jwt/jwt/pull/313) - [@​duhaesbaert](https://togithub.com/duhaesbaert) made their first contribution in [https://github.com/golang-jwt/jwt/pull/341](https://togithub.com/golang-jwt/jwt/pull/341) - [@​epelc](https://togithub.com/epelc) made their first contribution in [https://github.com/golang-jwt/jwt/pull/343](https://togithub.com/golang-jwt/jwt/pull/343) - [@​tareksha](https://togithub.com/tareksha) made their first contribution in [https://github.com/golang-jwt/jwt/pull/351](https://togithub.com/golang-jwt/jwt/pull/351) **Full Changelog**: golang-jwt/jwt@v5.0.0...v5.1.0 </details> --- ### Configuration π **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). π¦ **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. π **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/infratographer/x). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR reduces the scope of ToLower for strings and can provide a significant performance gain when validating Token Strings.