{"record":{"id":"b3882f50feaeeb41","repo":"micro/go-micro","slug":"invalid-token-format-expected-bearer-token","errorCode":null,"errorMessage":"invalid token format, expected 'Bearer <token>'","messagePattern":"invalid token format, expected 'Bearer <token>'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"wrapper/auth/metadata.go","lineNumber":22,"sourceCode":"\t\"errors\"\n\t\"strings\"\n\n\t\"go-micro.dev/v6/auth\"\n\t\"go-micro.dev/v6/metadata\"\n)\n\nconst (\n\t// MetadataKeyAuthorization is the key for the Authorization header in metadata\n\tMetadataKeyAuthorization = \"Authorization\"\n\t// BearerPrefix is the prefix for Bearer tokens\n\tBearerPrefix = \"Bearer \"\n)\n\nvar (\n\t// ErrMissingToken is returned when no authorization token is found in metadata\n\tErrMissingToken = errors.New(\"missing authorization token in metadata\")\n\t// ErrInvalidToken is returned when the token format is invalid\n\tErrInvalidToken = errors.New(\"invalid token format, expected 'Bearer <token>'\")\n)\n\n// TokenFromMetadata extracts the Bearer token from request metadata.\n// Returns the token string without the \"Bearer \" prefix, or an error if not found.\nfunc TokenFromMetadata(md metadata.Metadata) (string, error) {\n\t// Check for Authorization header\n\tauthHeader, ok := md.Get(MetadataKeyAuthorization)\n\tif !ok {\n\t\t// Also check lowercase version\n\t\tauthHeader, ok = md.Get(strings.ToLower(MetadataKeyAuthorization))\n\t\tif !ok {\n\t\t\treturn \"\", ErrMissingToken\n\t\t}\n\t}\n\n\t// Verify Bearer prefix\n\tif !strings.HasPrefix(authHeader, BearerPrefix) {\n\t\treturn \"\", ErrInvalidToken","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/micro/go-micro/blob/24529f140421a11a33b6999ab7944f2021cfd69c/wrapper/auth/metadata.go#L4-L40","documentation":"ErrInvalidToken is returned when the Authorization metadata value exists but does not start with 'Bearer ', or the token after the prefix is empty. The library strictly expects the 'Bearer <token>' format per RFC 6750.","triggerScenarios":"TokenFromMetadata receives md with Authorization set to a raw token without the 'Bearer ' prefix (e.g. just 'eyJhbG...'), 'Basic xxx', or 'Bearer ' with no token; hand-rolled header construction bypassing TokenToMetadata.","commonSituations":"Tokens copied from other systems that use raw values; lowercasing the header to 'bearer token' (case-sensitive prefix check fails); frontends sending 'Token ' or no scheme; empty token variables formatted anyway.","solutions":["Format the header exactly as 'Bearer '+token using auth.TokenToMetadata","Ensure the token itself is non-empty before setting metadata","If a peer sends a different scheme, normalize on the client or relax/branch the server check before calling TokenFromMetadata","Check for accidental lowercasing of the 'Bearer ' prefix in proxy layers"],"exampleFix":"// before\nmd.Set(\"Authorization\", token) // raw token\n// after\nmd := auth.TokenToMetadata(metadata.Metadata{}, token) // sets \"Bearer <token>\"","handlingStrategy":"validation","validationCode":"func validBearerHeader(md metadata.Metadata) bool {\n\tv, ok := md.Get(\"Authorization\")\n\treturn ok && strings.HasPrefix(v, \"Bearer \") && len(strings.TrimPrefix(v, \"Bearer \")) > 0\n}\n// if !validBearerHeader(md) { md = auth.TokenToMetadata(md, token) }","typeGuard":"func isInvalidToken(err error) bool { return errors.Is(err, auth.ErrInvalidToken) }","tryCatchPattern":"token, err := auth.TokenFromMetadata(md)\nif errors.Is(err, auth.ErrInvalidToken) {\n\t// client sent a malformed Authorization value; return 401 with hint\n\treturn errors.New(\"unauthorized: expected 'Bearer <token>'\")\n}","preventionTips":["Never set Authorization manually; use auth.TokenToMetadata","Check the token is non-empty before writing the header","Avoid lowercasing the 'Bearer ' scheme in proxies (prefix check is case-sensitive)","Document the required 'Bearer <token>' scheme for all clients"],"tags":["auth","metadata","bearer-token","token-format"],"backgroundTag":"invalid-token-format","analyzedSha":"24529f140421a11a33b6999ab7944f2021cfd69c","analyzedAt":"2026-09-01T02:52:24.923Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}