Skip to content

Malformed Bearer header passes undefined apiKey to chat controller #493

@deepak0x

Description

@deepak0x

Description

The chat API route extracts the API key with req.headers.get("Authorization")?.split(" ")[1]. If a client sends Authorization: Bearer (no token) or just Authorization: Bearer , split(" ")[1] is undefined or empty string. This undefined value gets passed as apiKey into the controller without any validation.

Steps to reproduce

  1. Send a POST to /api/v1/{projectId}/chat with header Authorization: Bearer (no token after the space)
  2. The request proceeds with apiKey: undefined

Expected behavior

Return 401 if the token is missing or empty.

Actual behavior

Undefined apiKey is passed to runTurnController.execute(), which may cause a cryptic downstream error or silently bypass validation.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions