aws-amplify / aws-amplify/amplify-android
Missing "Bearer" keyword in Authorization Header
- Dominant language
- Java
- Stars
- 287
- Forks
- 132
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 45
Description
### Before opening, please confirm:
- [x] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-android/issues?q=is%3Aissue+) and [discussions](https://github.com/aws-amplify/amplify-android/discussions).
### Language and Async Model
Kotlin
### Amplify Categories
Authentication
### Gradle script dependencies
```kotlin
// Put output below this line
amplify = "2.27.1"
aws-amplify-core = { module = "com.amplifyframework:core", version.ref = "amplify" }
aws-amplify-auth = { module = "com.amplifyframework:aws-auth-cognito", version.ref = "amplify" }
aws-amplify-api = { module = "com.amplifyframework:aws-api", version.ref = "amplify" }
```
### Environment information
```
# Put output below this line
------------------------------------------------------------
Gradle 8.11.1
------------------------------------------------------------
Build time: 2024-11-20 16:56:46 UTC
Revision: 481cb05a490e0ef9f8620f7873b83bd8a72e7c39
Kotlin: 2.0.20
Groovy: 3.0.22
Ant: Apache Ant(TM) version 1.10.14 compiled on August 16 2023
Launcher JVM: 21.0.4 (Eclipse Adoptium 21.0.4+7-LTS)
Daemon JVM: /Users/xxx/Library/Java/JavaVirtualMachines/temurin-21.0.4/Contents/Home (no JDK specified, using current Java home)
OS: Mac OS X 15.5 aarch64
```
### Please include any relevant guides or documentation you're referencing
_No response_
### Describe the bug
Amplify does not add the "Bearer" keyword to the Authorization Header with the accessToken which is the standard. Many other tools are expecting this keyword in order to use default security mechanisms without custom handling (e.g. SpringBoot). It is possible to add another custom Authorization Header including this but some WAFs will throw errors due to duplicate headers.
### Reproduction steps (if applicable)
_No response_
### Code Snippet
```kotlin
// Put your code below this line.
```
### Log output
```
// Put your logs below this line
```
### Configuration File
_No response_
### GraphQL Schema
```graphql
// Put your schema below this line
```
### Additional information and screenshots
_No response_
Contributor guide
Research direction
Start by locating where Amplify Auth uses the access token to construct the Authorization header and review the existing authentication or API tests. Reproduce a request with Amplify 2.27.1, then verify the header uses the standard Bearer form without creating duplicate Authorization headers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, aws, kotlin
- Domain
- authentication, mobile
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100