aws-amplify / aws-amplify/amplify-android

Missing "Bearer" keyword in Authorization Header

Open
#3,080 6 comments 0 reactions 0 assignees View on GitHub
api question
Dominant language
Java
Stars
287
Forks
132
Avg merge
2d 2h
Merged PRs (30d)
45

Description

### Before opening, please confirm:

- [x] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-android/issues?q=is%3Aissue+) and [discussions](https://github.com/aws-amplify/amplify-android/discussions).

### Language and Async Model

Kotlin

### Amplify Categories

Authentication

### Gradle script dependencies

```kotlin
// Put output below this line

amplify = "2.27.1"
aws-amplify-core = { module = "com.amplifyframework:core", version.ref = "amplify" }
aws-amplify-auth = { module = "com.amplifyframework:aws-auth-cognito", version.ref = "amplify" }
aws-amplify-api = { module = "com.amplifyframework:aws-api", version.ref = "amplify" }
```

### Environment information

```
# Put output below this line

------------------------------------------------------------
Gradle 8.11.1
------------------------------------------------------------

Build time: 2024-11-20 16:56:46 UTC
Revision: 481cb05a490e0ef9f8620f7873b83bd8a72e7c39

Kotlin: 2.0.20
Groovy: 3.0.22
Ant: Apache Ant(TM) version 1.10.14 compiled on August 16 2023
Launcher JVM: 21.0.4 (Eclipse Adoptium 21.0.4+7-LTS)
Daemon JVM: /Users/xxx/Library/Java/JavaVirtualMachines/temurin-21.0.4/Contents/Home (no JDK specified, using current Java home)
OS: Mac OS X 15.5 aarch64

```

### Please include any relevant guides or documentation you're referencing

_No response_

### Describe the bug

Amplify does not add the "Bearer" keyword to the Authorization Header with the accessToken which is the standard. Many other tools are expecting this keyword in order to use default security mechanisms without custom handling (e.g. SpringBoot). It is possible to add another custom Authorization Header including this but some WAFs will throw errors due to duplicate headers.

Image

### Reproduction steps (if applicable)

_No response_

### Code Snippet

```kotlin
// Put your code below this line.

```

### Log output

```
// Put your logs below this line

```

### Configuration File

_No response_

### GraphQL Schema

```graphql
// Put your schema below this line

```

### Additional information and screenshots

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by locating where Amplify Auth uses the access token to construct the Authorization header and review the existing authentication or API tests. Reproduce a request with Amplify 2.27.1, then verify the header uses the standard Bearer form without creating duplicate Authorization headers.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, aws, kotlin
Domain
authentication, mobile
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.