view release on metacpan or  search on metacpan

lib/Catalyst/Plugin/OAuth2/ResourceServer.pm  view on Meta::CPAN

    my ($jwt) = $auth =~ /\A Bearer \s+ (\S+) \z/xi;
    unless ( defined $jwt && length $jwt ) {
        # RFC 6750 section 3: a malformed *Bearer* attempt is invalid_request; an
        # absent header or a different/unsupported scheme gets a bare 401.
        if ( $auth =~ /\A \s* Bearer \b/xi ) {
            $c->oauth_challenge(
                Catalyst::Plugin::OAuth2::ResourceServer::Error->new(
                    error => 'invalid_request', http_status => 400 ) );
        }
        else {
            $c->oauth_challenge;    # no credentials -> plain 401
        }
        return 0;
    }

    # Token verification: a structured Error is a token failure (-> its 401);
    # anything else (engine misconfig, internal bug) is a 500, never invalid_token.
    my $verified = 1;
    my $claims = try {
        $c->_oauth_rs_engine->verify_token($jwt);
    }