{"record":{"id":"d37439dcdd965b50","repo":"dgraph-io/dgraph","slug":"invalid-bearer-formatted-header-value-for-jwt-s","errorCode":null,"errorMessage":"invalid Bearer-formatted header value for JWT (%s)","messagePattern":"invalid Bearer-formatted header value for JWT \\((.+?)\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"graphql/authorization/auth.go","lineNumber":220,"sourceCode":"\treturn a.Header\n}\n\n// AttachAuthorizationJwt adds any incoming JWT authorization data into the grpc context metadata.\nfunc (a *AuthMeta) AttachAuthorizationJwt(ctx context.Context,\n\theader http.Header) (context.Context, error) {\n\tif a == nil {\n\t\treturn ctx, nil\n\t}\n\n\tauthHeaderVal := header.Get(a.Header)\n\tif authHeaderVal == \"\" {\n\t\treturn ctx, nil\n\t}\n\n\tif strings.HasPrefix(strings.ToLower(authHeaderVal), \"bearer \") {\n\t\tparts := strings.Split(authHeaderVal, \" \")\n\t\tif len(parts) != 2 {\n\t\t\treturn ctx, fmt.Errorf(\"invalid Bearer-formatted header value for JWT (%s)\",\n\t\t\t\tauthHeaderVal)\n\t\t}\n\t\tauthHeaderVal = parts[1]\n\t}\n\n\tmd, ok := metadata.FromIncomingContext(ctx)\n\tif !ok {\n\t\tmd = metadata.New(nil)\n\t}\n\n\tmd.Append(string(AuthJwtCtxKey), authHeaderVal)\n\tctx = metadata.NewIncomingContext(ctx, md)\n\treturn ctx, nil\n}\n\ntype CustomClaims struct {\n\tauthMeta      *AuthMeta\n\tAuthVariables map[string]interface{}","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/graphql/authorization/auth.go#L202-L238","documentation":"In `AttachAuthorizationJwt`, Dgraph reads the incoming HTTP Authorization header and, if it starts with `bearer ` (case-insensitive), expects the header to contain exactly two space-separated parts: the literal \"Bearer\" and the token. Any other spacing/parts count fails with this message, which includes the offending header value.","triggerScenarios":"Sending an Authorization header with a Bearer prefix but extra spaces (e.g. \"Bearer  abc.def.ghi\" with a double space produces 3 parts), or \"Bearer\" with no token, or a token value containing a space (e.g. newline-wrapped PEM-ish content pasted into the header).","commonSituations":"HTTP clients that collapse or duplicate whitespace; hand-built curl commands with a typo; token accidentally including a trailing space plus another value; frameworks that prepend \"Bearer\" while the code already included it.","solutions":["Send the header as exactly `Authorization: Bearer <token>` with a single space and no extra whitespace","Trim the JWT and ensure it contains no internal spaces (JWTs are three dot-separated base64url segments)","Remove a duplicated Bearer prefix if your client library also adds one","Alternatively omit the Bearer prefix and send the raw token, which bypasses this parsing branch"],"exampleFix":"// before\ncurl -H 'Authorization: Bearer  eyJhbGciOi... ' /graphql\n// after\ncurl -H 'Authorization: Bearer eyJhbGciOi...' /graphql","handlingStrategy":"validation","validationCode":"function setAuthHeader(token) {\n  const t = String(token).trim();\n  if (/\\s/.test(t)) throw new Error('JWT must not contain whitespace');\n  return { Authorization: `Bearer ${t}` };\n}","typeGuard":"const isBearerHeader = (v) => /^Bearer\\s+\\S+$/.test(v);","tryCatchPattern":null,"preventionTips":["Use your HTTP client's Bearer-token option instead of hand-building the header","Trim tokens read from env/files (trailing newlines are common)","Never embed tokens with spaces in headers"],"tags":["jwt","http-header","authentication"],"backgroundTag":"malformed-authorization-header","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}