Add bearer_auth config toggle for Authorization scheme#13400
Open
williammartin wants to merge 1 commit into
Open
Add bearer_auth config toggle for Authorization scheme#13400williammartin wants to merge 1 commit into
bearer_auth config toggle for Authorization scheme#13400williammartin wants to merge 1 commit into
Conversation
94637de to
340416f
Compare
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
340416f to
937d129
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new configuration toggle (bearer_auth) and env var (GH_BEARER_AUTH) to control whether gh uses Authorization: token … (default) or Authorization: Bearer … when attaching auth tokens to HTTP requests, including during login/refresh/status flows.
Changes:
- Introduces
bearer_authconfig option (per-host) andAuthConfig.BearerAuth(host)resolution (env var override + config lookup). - Updates auth-related HTTP requests and transports to emit
Bearerwhen enabled, and threads the toggle through login, refresh, status, and OAuth viewer verification. - Expands tests to cover config/env resolution and Authorization header behavior.
Show a summary per file
| File | Description |
|---|---|
| pkg/cmd/config/list/list_test.go | Updates config listing expectations to include bearer_auth. |
| pkg/cmd/auth/status/status.go | Threads bearer-auth setting into scope lookup during gh auth status. |
| pkg/cmd/auth/shared/oauth_scopes.go | Updates scope-check requests to use the configured Authorization scheme. |
| pkg/cmd/auth/shared/oauth_scopes_test.go | Adds coverage asserting Bearer Authorization header behavior. |
| pkg/cmd/auth/shared/login_flow.go | Threads bearer-auth through login flow and centralizes header formatting in helper. |
| pkg/cmd/auth/refresh/refresh.go | Threads bearer-auth through refresh flow and scope discovery. |
| pkg/cmd/auth/refresh/refresh_test.go | Updates refresh tests for new AuthFlow signature. |
| pkg/cmd/auth/login/login.go | Uses bearer-auth setting when validating token and fetching current login. |
| pkg/cmd/api/api_test.go | Switches some tests to use isolated test config instead of a ConfigMock. |
| internal/gh/mock/config.go | Extends generated ConfigMock with BearerAuth support (but needs import formatting fix). |
| internal/gh/gh.go | Extends gh.Config and gh.AuthConfig interfaces to support bearer-auth. |
| internal/config/stub.go | Ensures config stub forwards BearerAuth lookups. |
| internal/config/config.go | Adds bearer_auth config plumbing, defaults, and env/config resolution in AuthConfig. |
| internal/config/auth_config_test.go | Adds tests for AuthConfig.BearerAuth behavior (default/global/host/env). |
| internal/authflow/flow.go | Threads bearer-auth into OAuth viewer lookup used after OAuth flow. |
| internal/authflow/flow_test.go | Adds test asserting Bearer Authorization header in OAuth viewer lookup. |
| api/http_client.go | Updates AddAuthTokenHeader to select token vs Bearer per host. |
| api/http_client_test.go | Adds coverage for Bearer Authorization header in HTTP client transport. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Files not reviewed (1)
- internal/gh/mock/config.go: Language not supported
- Files reviewed: 17/18 changed files
- Comments generated: 1
Comment on lines
7
to
+9
| "github.com/cli/cli/v2/internal/gh" | ||
| o "github.com/cli/cli/v2/pkg/option" | ||
| "sync" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
bearer_authconfig setting andGH_BEARER_AUTHenvironment variable to control the Authorization header scheme used in HTTP requests.When enabled,
Authorization: token <TOKEN>becomesAuthorization: Bearer <TOKEN>.Motivation
Resolves #11727
Enterprise proxy setups (e.g. Envoy/Nginx) may only accept standard
Authorization: BearerorAuthorization: Basicschemes, rejecting the GitHub-specificAuthorization: tokenscheme. This blocks the ability to useghCLI and extensions behind such proxies.Changes
bearer_auth(enabled/disabled, defaultdisabled, per-host configurable)GH_BEARER_AUTH(global override)AddAuthTokenHeaderto use Bearer scheme when enabled--with-token), refresh, status, and OAuth verificationUsage
Companion PR
The corresponding
go-ghchanges for extension support: cli/go-gh#222