diff --git a/flask_jwt_extended/view_decorators.py b/flask_jwt_extended/view_decorators.py index 7b319597..eed3b682 100644 --- a/flask_jwt_extended/view_decorators.py +++ b/flask_jwt_extended/view_decorators.py @@ -188,7 +188,7 @@ def _decode_jwt_from_headers(): if header_type: field_values = split(r',\s*', auth_header) jwt_header = [s for s in field_values if s.split()[0] == header_type] - if len(jwt_header) < 1: + if len(jwt_header) < 1 or len(jwt_header[0].split()) != 2: msg = "Bad {} header. Expected value '{} '".format( header_name, header_type diff --git a/tests/test_headers.py b/tests/test_headers.py index 1874d93b..112cf980 100644 --- a/tests/test_headers.py +++ b/tests/test_headers.py @@ -151,6 +151,15 @@ def custom_response(err_str): assert response.get_json() == {'foo': "bar"} +def test_header_without_jwt(app): + jwtM = get_jwt_manager(app) + test_client = app.test_client() + + access_headers = {'Authorization': 'Bearer '} + response = test_client.get('/protected', headers=access_headers) + assert response.status_code == 422 + assert response.get_json() == {'msg': "Bad Authorization header. Expected value 'Bearer '"} + def test_custom_error_msg_key(app): app.config['JWT_ERROR_MESSAGE_KEY'] = 'message' response = app.test_client().get('/protected', headers=None)