middleware/keyauth/keyauth.go (1)

59-78: Consider the previous performance optimization suggestion.

The current implementation builds challenges using strings.Builder which is good. However, the previous review comment suggested avoiding multiple string allocations within the loop by reusing a single builder. The current implementation already uses strings.Builder efficiently, so this is acceptable.

middleware/keyauth/extractors.go (1)

62-68: Consider optimizing the scheme validation logic.

The current implementation checks the scheme length and validity separately. This could be simplified for better readability.

-if len(authHeader) <= schemeLen || !strings.EqualFold(authHeader[:schemeLen], authScheme) {
-    return "", ErrMissingOrMalformedAPIKey
-}
-rest := authHeader[schemeLen:]
-if len(rest) == 0 || rest[0] != ' ' {
-    return "", ErrMissingOrMalformedAPIKey
-}
+if !strings.HasPrefix(strings.ToLower(authHeader), strings.ToLower(authScheme)+" ") {
+    return "", ErrMissingOrMalformedAPIKey
+}
+rest := authHeader[schemeLen:]

docs/whats_new.md (2)

1159-1160: Clarify 401 vs 407 header and tighten wording (mention tabs, absolute URI).

Good summary. Please explicitly call out Proxy-Authenticate for 407 and keep token68/whitespace rules in one place.

Apply:

- New `Challenge`, `Error`, `ErrorDescription`, `ErrorURI`, and `Scope` fields allow customizing the `WWW-Authenticate` header, returning Bearer error details, and specifying required scopes. `ErrorURI` values are validated as absolute, a default `ApiKey` challenge is emitted when using non-Authorization extractors, Bearer `error` values are validated, credentials must conform to RFC 7235 `token68` syntax, and `scope` values are checked against RFC 6750's `scope-token` format. The header is also emitted only after the status code is finalized.
+ New `Challenge`, `Error`, `ErrorDescription`, `ErrorURI`, and `Scope` fields allow customizing challenge headers and Bearer error details. `ErrorURI` must be an absolute URI. Credentials in Authorization must follow RFC 7235 token68 (only trailing `=` padding) and must not contain spaces or tabs (tabs between scheme and credentials are rejected). When non-Authorization extractors are used, an `ApiKey` challenge is emitted by default. When multiple extractors are chained, all schemes are advertised in the challenge. The challenge header is emitted only after the final status is known (`WWW-Authenticate` for 401, `Proxy-Authenticate` for 407).

---

2089-2090: Mirror 407 behavior note in migration section.

Echo the Proxy-Authenticate detail here for consistency.

- New `Challenge`, `Error`, `ErrorDescription`, `ErrorURI`, and `Scope` options let you customize challenge responses, include Bearer error parameters, and specify required scopes. `ErrorURI` values are validated as absolute, credentials containing whitespace are rejected, and when multiple authorization extractors are chained, all schemes are advertised in the `WWW-Authenticate` header. The middleware defers emitting `WWW-Authenticate` until a 401 status is final, and `FromAuthHeader` now trims surrounding whitespace.
+ New `Challenge`, `Error`, `ErrorDescription`, `ErrorURI`, and `Scope` options let you customize challenge responses, include Bearer error parameters, and specify required scopes. `ErrorURI` must be absolute. Authorization credentials must follow RFC 7235 token68 (only trailing `=`) and cannot contain spaces or tabs (tabs between scheme and credentials are rejected). When multiple authorization extractors are chained, all schemes are advertised. The middleware emits the challenge only after the final status is known (`WWW-Authenticate` on 401, `Proxy-Authenticate` on 407). `FromAuthHeader` also trims surrounding whitespace.

middleware/keyauth/keyauth_test.go (3)

885-901: Custom challenge happy-path covered.

Solid. Consider also asserting that no Bearer error params leak into non-Bearer schemes.

---

691-711: Add negative tests for tabs and embedded whitespace in token.

Extractor rejects tabs between scheme and token and any spaces/tabs within token; add explicit cases.

Example additions:

func Test_HeaderSchemeTabBetweenSchemeAndToken(t *testing.T) {
	app := fiber.New()
	app.Use(New(Config{Validator: func(_ fiber.Ctx, _ string) (bool, error) { return false, ErrMissingOrMalformedAPIKey }}))
	app.Get("/", func(c fiber.Ctx) error { return c.SendString("OK") })

	req := httptest.NewRequest(fiber.MethodGet, "/", nil)
	req.Header.Add("Authorization", "Bearer\t"+CorrectKey)
	res, err := app.Test(req)
	require.NoError(t, err)
	require.Equal(t, http.StatusUnauthorized, res.StatusCode)
}
func Test_HeaderSchemeSpaceInsideToken(t *testing.T) {
	app := fiber.New()
	app.Use(New(Config{Validator: func(_ fiber.Ctx, _ string) (bool, error) { return false, ErrMissingOrMalformedAPIKey }}))
	app.Get("/", func(c fiber.Ctx) error { return c.SendString("OK") })

	req := httptest.NewRequest(fiber.MethodGet, "/", nil)
	req.Header.Add("Authorization", "Bearer to ken")
	res, err := app.Test(req)
	require.NoError(t, err)
	require.Equal(t, http.StatusUnauthorized, res.StatusCode)
}

Also applies to: 713-784

---

552-585: Add token68 padding edge cases.

Cover acceptance of trailing '=' padding and rejection of '=' in the middle.

Example additions:

func Test_HeaderSchemeToken68PaddingAccepted(t *testing.T) {
	app := fiber.New()
	app.Use(New(Config{
		Validator: func(_ fiber.Ctx, key string) (bool, error) { return key == "abc==" , nil },
	}))
	app.Get("/", func(c fiber.Ctx) error { return c.SendString("OK") })

	req := httptest.NewRequest(fiber.MethodGet, "/", nil)
	req.Header.Add("Authorization", "Bearer abc==")
	res, err := app.Test(req)
	require.NoError(t, err)
	require.Equal(t, http.StatusOK, res.StatusCode)
}
func Test_HeaderSchemeToken68EqualsInMiddleRejected(t *testing.T) {
	app := fiber.New()
	app.Use(New(Config{Validator: func(_ fiber.Ctx, _ string) (bool, error) { return false, ErrMissingOrMalformedAPIKey }}))
	app.Get("/", func(c fiber.Ctx) error { return c.SendString("OK") })

	req := httptest.NewRequest(fiber.MethodGet, "/", nil)
	req.Header.Add("Authorization", "Bearer ab=c")
	res, err := app.Test(req)
	require.NoError(t, err)
	require.Equal(t, http.StatusUnauthorized, res.StatusCode)
}

Also applies to: 587-633, 646-654

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/csrf/csrf_test.go:188-193
Timestamp: 2024-09-25T15:57:10.221Z
Learning: In the Fiber framework tests, using `ctx.Response.Header.Cookie` may not be suitable for parsing cookies from the response header, as it requires a `*Cookie` and fills it rather than returning a string value; thus, manual parsing of the `Set-Cookie` header may be necessary.

Learnt from: dave-gray101
PR: gofiber/fiber#3027
File: docs/api/middleware/keyauth.md:222-222
Timestamp: 2024-10-08T19:06:06.583Z
Learning: The `KeyLookup` field in the `keyauth` middleware does not support pipe-delimited keys. Instead, it specifies a single source and name for key extraction, with additional sources specified in the `FallbackKeyLookups` field.

Learnt from: sixcolors
PR: gofiber/fiber#3625
File: middleware/session/config.go:57-58
Timestamp: 2025-07-27T17:28:53.403Z
Learning: In the session middleware `Config` struct, the `Extractor` field uses function closures (like `FromCookie(key)`), making it impossible to introspect extractor parameters at runtime for validation purposes without complex reflection techniques.

middleware/keyauth/extractors.go (1)

9-14: Spec-correct token68 helper—nice extraction.

Char set matches RFC 7235 token68 and resolves the previous readability ask to extract a helper.

middleware/keyauth/extractors.go (1)

88-101: Avoid shadowing c (fiber.Ctx) with a byte variable.

Renaming improves readability and avoids accidental confusion.

-				for j := 0; j < len(token); j++ {
-					c := token[j]
-					if !isToken68Char(c) {
+				for j := 0; j < len(token); j++ {
+					ch := token[j]
+					if !isToken68Char(ch) {
 						return "", ErrMissingOrMalformedAPIKey
 					}
-					if c == '=' {
+					if ch == '=' {
 						if j == 0 {
 							return "", ErrMissingOrMalformedAPIKey
 						}
 						seenEq = true
-					} else if seenEq {
+					} else if seenEq {
 						return "", ErrMissingOrMalformedAPIKey
 					}
 				}

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

middleware/keyauth/keyauth.go (3)

80-83: Don’t overwrite an auth header already set by the ErrorHandler.

Respect a pre-set header by appending, otherwise set it.

-                c.Set(header, strings.Join(challenges, ", "))
+                v := strings.Join(challenges, ", ")
+                if len(c.Response().Header.Peek(header)) == 0 {
+                    c.Set(header, v)
+                } else {
+                    c.Append(header, v)
+                }
-            } else if cfg.Challenge != "" {
-                c.Set(header, cfg.Challenge)
+            } else if cfg.Challenge != "" {
+                if len(c.Response().Header.Peek(header)) == 0 {
+                    c.Set(header, cfg.Challenge)
+                } else {
+                    c.Append(header, cfg.Challenge)
+                }
             }

---

62-76: Avoid fmt.Fprintf in hot path; use WriteString + strconv.Quote.

Trim fmt overhead while keeping safe quoting.

-                    var b strings.Builder
-                    fmt.Fprintf(&b, "%s realm=%q", scheme, cfg.Realm)
+                    var b strings.Builder
+                    b.WriteString(scheme)
+                    b.WriteString(" realm=")
+                    b.WriteString(strconv.Quote(cfg.Realm))
                     if utils.EqualFold(scheme, "Bearer") {
                         if cfg.Error != "" {
-                            fmt.Fprintf(&b, ", error=%q", cfg.Error)
+                            b.WriteString(", error=")
+                            b.WriteString(strconv.Quote(cfg.Error))
                             if cfg.ErrorDescription != "" {
-                                fmt.Fprintf(&b, ", error_description=%q", cfg.ErrorDescription)
+                                b.WriteString(", error_description=")
+                                b.WriteString(strconv.Quote(cfg.ErrorDescription))
                             }
                             if cfg.ErrorURI != "" {
-                                fmt.Fprintf(&b, ", error_uri=%q", cfg.ErrorURI)
+                                b.WriteString(", error_uri=")
+                                b.WriteString(strconv.Quote(cfg.ErrorURI))
                             }
                             if cfg.Error == ErrorInsufficientScope {
-                                fmt.Fprintf(&b, ", scope=%q", cfg.Scope)
+                                b.WriteString(", scope=")
+                                b.WriteString(strconv.Quote(cfg.Scope))
                             }
                         }
                     }

Also update imports:

-import (
-    "errors"
-    "fmt"
-    "strings"
+import (
+    "errors"
+    "strconv"
+    "strings"

---

100-112: Deduplicate advertised schemes; preserve order.

If the chain repeats the same SourceAuthHeader scheme, the header will list duplicates.

-func getAuthSchemes(e Extractor) []string {
-    var schemes []string
-    if e.Source == SourceAuthHeader && e.AuthScheme != "" {
-        schemes = append(schemes, e.AuthScheme)
-    }
-    for _, ex := range e.Chain {
-        schemes = append(schemes, getAuthSchemes(ex)...)
-    }
-    return schemes
-}
+func getAuthSchemes(e Extractor) []string {
+    schemes := make([]string, 0, 4)
+    seen := make(map[string]struct{}, 4)
+    var walk func(Extractor)
+    walk = func(ex Extractor) {
+        if ex.Source == SourceAuthHeader && ex.AuthScheme != "" {
+            if _, ok := seen[ex.AuthScheme]; !ok {
+                seen[ex.AuthScheme] = struct{}{}
+                schemes = append(schemes, ex.AuthScheme)
+            }
+        }
+        for _, ch := range ex.Chain {
+            walk(ch)
+        }
+    }
+    walk(e)
+    return schemes
+}

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro