{"record":{"id":"c066963d49a5ddd5","repo":"Kuberwastaken/claurst","slug":"invalid-bearer-token-header","errorCode":null,"errorMessage":"invalid bearer token header: {}","messagePattern":"invalid bearer token header: (.+?)","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src-rust/crates/mcp/src/lib.rs","lineNumber":402,"sourceCode":"        /// Subscribe to raw JSON notifications from the transport.\r\n        /// Returns an async stream of notification messages.\r\n        ///\r\n        /// For transports that natively support push notifications (e.g., WebSocket),\r\n        /// this returns a stream that yields messages directly from the transport.\r\n        /// For transports without native push support (e.g., stdio), this returns\r\n        /// a stream that polls periodically.\r\n        fn subscribe_to_notifications(\r\n            &self,\r\n        ) -> BoxStream<'static, anyhow::Result<serde_json::Value>>;\r\n\r\n        fn protocol_version(&self) -> &'static str {\r\n            LEGACY_PROTOCOL_VERSION\r\n        }\r\n    }\r\n\r\n    pub(crate) fn bearer_header_value(token: &str) -> anyhow::Result<HeaderValue> {\r\n        HeaderValue::from_str(&format!(\"Bearer {}\", token))\r\n            .map_err(|e| anyhow::anyhow!(\"invalid bearer token header: {}\", e))\r\n    }\r\n\r\n    pub(crate) fn is_event_stream_response(response: &reqwest::Response) -> bool {\r\n        response\r\n            .headers()\r\n            .get(CONTENT_TYPE)\r\n            .and_then(|value| value.to_str().ok())\r\n            .map(|value| value.contains(\"text/event-stream\"))\r\n            .unwrap_or(false)\r\n    }\r\n\r\n    pub(crate) fn resolve_legacy_endpoint(base_url: &str, endpoint: &str) -> anyhow::Result<String> {\r\n        let endpoint = endpoint.trim();\r\n        if endpoint.is_empty() {\r\n            anyhow::bail!(\"legacy SSE endpoint event did not include a POST endpoint\");\r\n        }\r\n        if let Ok(url) = url::Url::parse(endpoint) {\r\n            return Ok(url.to_string());\r","sourceCodeStart":384,"sourceCodeEnd":420,"githubUrl":"https://github.com/Kuberwastaken/claurst/blob/b0637c97ec34144387cbf2f74f65df6d16a6cef1/src-rust/crates/mcp/src/lib.rs#L384-L420","documentation":"bearer_header_value builds an HTTP `Authorization: Bearer <token>` header from a raw token string. HeaderValue::from_str rejects any string containing non-visible-ASCII bytes (control chars, non-ASCII). The library wraps that rejection in this error, meaning the supplied token itself is not a valid HTTP header value.","triggerScenarios":"Calling bearer_header_value (directly or via MCP connect/auth flows) with a token containing newlines, CR/LF (header injection), NUL bytes, or non-ASCII UTF-8 characters (e.g. a password or pasted string with smart quotes).","commonSituations":"Token read from a malformed config file or env var with a trailing newline that wasn't trimmed; pasted token containing invisible whitespace; a token that is actually a multi-line PEM/secret rather than a bearer token.","solutions":["Trim whitespace and strip newlines from the token before passing it: token.trim()","Verify the token source (env var, file, config) doesn't embed control or non-ASCII characters","Ensure the value is a bearer token, not a certificate/multiline secret","Log the token length and char classes (not the token) to find offending bytes"],"exampleFix":"// before\nlet header = bearer_header_value(&token)?;\n// after\nlet header = bearer_header_value(token.trim())?;","handlingStrategy":"validation","validationCode":"fn is_valid_header_value(s: &str) -> bool {\n    s.bytes().all(|b| (32..=126).contains(&b) || b == b'\\t')\n}","typeGuard":null,"tryCatchPattern":"match bearer_header_value(token.trim()) {\n    Ok(h) => /* use h */,\n    Err(e) => eprintln!(\"bad token encoding: {e}\"),\n}","preventionTips":["Always token.trim() after reading from env/files","Reject tokens with non-ASCII bytes at config-load time","Never paste multi-line secrets into a bearer-token field"],"tags":["http","authentication","header-value"],"backgroundTag":"invalid-argument-format","analyzedSha":"b0637c97ec34144387cbf2f74f65df6d16a6cef1","analyzedAt":"2026-09-10T00:24:58.650Z","contentChangedAt":"2026-09-10T00:24:58.650Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}