[Bug]: jwt-auth policy param authHeaderPrefix does not accept empty string ("")

Please select the area the issue is related to

Area/Policies

Please select the aspect the issue is related to

Aspect/Configuration

Description

In the jwt-auth policy, an empty string works at the system parameter level (authHeaderScheme: "") to disable the scheme prefix and accept a raw token. But the equivalent policy user parameter authHeaderPrefix: "" is silently ignored, and the policy keeps enforcing the default Bearer prefix.

So there is no way for a policy user to configure "no scheme prefix" via authHeaderPrefix.

Steps to Reproduce

1. Configure the jwt-auth policy with headerName: x-auth-key and authHeaderPrefix: "".
2. Send a request with x-auth-key: <raw-jwt> (no Bearer prefix).
3. Expected: raw token is validated and the request is authenticated.
4. Actual: request is rejected with 401 invalid authorization header format — the Bearer prefix is still enforced.

Severity Level of the Issue

Severity/Minor

Environment Details (with versions)

• jwt-auth policy v1.0.4
• Platform-independent (configuration/logic issue)