Swagger-ui: Headers in lowercase, including bearer

[jacobweber]

| Q | A
| ------------------------------- | -------
| Bug or feature request? | Bug
| Which Swagger/OpenAPI version? | 2.0
| Which Swagger-UI version? | 3.1.5
| How did you install Swagger-UI? | download of dist folder
| Which broswer & version? | Chrome Version 60.0.3112.90 (Official Build) (64-bit)
| Which operating system? | Mac OS 10.12.6

Demonstration API definition

API with OAuth2 support

Configuration (browser query string, constructor, config.yaml)

Defaults

Expected Behavior

I authorized swagger-ui using the default settings, against my OAuth 2 server, with the "implicit" grant.

When using "try it out", it sends the following headers:
-H "accept: application/json" -H "authorization: bearer ..."

At least the "bearer" part of this should be uppercase: https://tools.ietf.org/html/rfc6750

Also, I think it's more standard to send title-case headers, although they're technically case-insensitive.

Current Behavior

"bearer" is lowercase.

Possible Solution

Context

[shockey]

This is a fair point!

The header is being set here, in swagger-client: https://github.com/swagger-api/swagger-js/blob/22f253344b80e13d06c6af8db62de28ed85fd338/src/execute.js#L283

Changing result.headers.authorization to result.headers['Authorization'] should do the trick.

[jacobweber]

You'd also need to change https://github.com/swagger-api/swagger-js/blob/22f253344b80e13d06c6af8db62de28ed85fd338/src/execute.js#L293 to make tokenType uppercase.

[dkarlovi]

This is a blocker for usages with OAuth2 APIs, should clearly be labeled as a bug, not an enhancement.

[webron]

Yup, this is a bug.

[webron]

@owenconti can you try fixing it? Should be fairly simple. This refers only to the "Bearer" string, the case of the header name is completely irrelevant.

[owenconti]

@shockey Should we force tokenType to always be uppercase or should it be the responsibility of whatever is setting the token_type value in the authorizations as seen here (from a test):

    const authorizations = {
        bearer: {
          token: {
            access_token: 'one two',
            token_type: 'this is not a bearer'
          }
        }
      }

      return Swagger({spec, authorizations}).then((client) => {

[webron]

When it comes to the _value_ of a header, we should never change the lettering case.

[shockey]

This was just fixed in https://github.com/swagger-api/swagger-js/pull/1156. Swagger-UI will receive the patch as part of our release this Friday 🎉

Closing!