From 542fbea31370644af5d205beba771246877c4094 Mon Sep 17 00:00:00 2001 From: John O'Keefe Date: Fri, 20 Feb 2026 17:03:53 -0500 Subject: [PATCH] fix(auth): correct JWT token lookup to strip Bearer prefix The TokenLookup config was missing the Bearer prefix stripper, causing all authenticated requests to fail with 'token is malformed'. The JWT library was trying to decode 'Bearer eyJh...' as a token, failing at the space character. Changed from: 'cookie:token,header:Authorization' Changed to: 'cookie:token,header:Authorization:Bearer ' This fixes all integration tests that use Bearer token authentication. --- internal/router/router.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/router/router.go b/internal/router/router.go index a2a515d..6b85f7a 100644 --- a/internal/router/router.go +++ b/internal/router/router.go @@ -66,7 +66,7 @@ func createJWTMiddleware(cfg *Config) echo.MiddlewareFunc { return echojwt.WithConfig(echojwt.Config{ SigningKey: []byte(cfg.Cfg.JWTSecret), ContextKey: "user", - TokenLookup: "cookie:token,header:Authorization", + TokenLookup: "cookie:token,header:Authorization:Bearer ", SuccessHandler: func(c echo.Context) { token := c.Get("user").(*jwt.Token) claims := token.Claims.(jwt.MapClaims)