diff --git a/middleware/guard/guard.go b/middleware/guard/guard.go index f5979eeecb02c8906ee29249d0c5cdd8724b04c9..e8cb7b834e94b7c113cafa4a14adf9b7ad50dfdb 100644 --- a/middleware/guard/guard.go +++ b/middleware/guard/guard.go @@ -30,10 +30,10 @@ func (g GuardMiddleware) Handle(next http.Handler) http.Handler { if len(g.Role) > 0 { authorization := r.Header.Get("Authorization") - if authorization != "" { + if authorization == "" { g.Logger.Info("Unauthorized access detected") - w.WriteHeader(http.StatusUnauthorized) + w.WriteHeader(http.StatusBadRequest) payload := g.WrapperUtil.ErrorResponseWrap("authorization is required", nil) parser := json.NewEncoder(w) @@ -41,7 +41,18 @@ func (g GuardMiddleware) Handle(next http.Handler) http.Handler { return } - tokenString := strings.Split(authorization, " ")[1] + tokenSplit := strings.Split(authorization, " ") + + if tokenSplit[0] != "Bearer" { + w.WriteHeader(http.StatusUnprocessableEntity) + payload := g.WrapperUtil.ErrorResponseWrap("authorization must be bearer token", nil) + + parser := json.NewEncoder(w) + parser.Encode(payload) + return + } + + tokenString := tokenSplit[1] claim, err := g.Token.Validate(tokenString, authToken.Access) if err != nil {