🐛 Cannot send HTTP with Bearer Authentication: ClientException (Failed to parse header value)

[AdrKacz]

🐛 Cannot send HTTP with Bearer Authentication: ClientException (Failed to parse header value)

I want to POST and GET an HTTP API that requires JWT authentication.

However, when I launch the request, it immediately fires ClientException (Failed to parse header value).

The locals in the error stack are:

request: Request (GET https://api-endpoint/status)
headers: _CompactLinkedCustomHashMap ({content-type: application/json, authorization: Bearer XXX})

I send the request with the following dart code:

await http.get(Uri.parse('https://api-endpoint/status'), headers: {
      HttpHeaders.contentTypeHeader: 'application/json',
      HttpHeaders.authorizationHeader: 'Bearer XXX'
    });

However, I had no issue testing the request using hoppscotch.io. I received the expected result without error. Here is the request sent by hoppscotch.io:

curl --request GET \
  --url https://api-endpoint/status \
  --header 'Authorization: Bearer XXX'

Any help will be appreciated 😁

Flutter doctor

[✓] Flutter (Channel stable, 3.3.8, on macOS 13.0.1 22A400 darwin-x64, locale en-GB)
[✓] Android toolchain - develop for Android devices (Android SDK version 30.0.3)
[✓] Xcode - develop for iOS and macOS (Xcode 14.1)
[✓] Chrome - develop for the web
[✓] Android Studio (version 2021.3)
[✓] VS Code (version 1.73.1)
[✓] Connected device (3 available)
[✓] HTTP Host Availability

Pubspec dependencies

dependencies:
  flutter:
    sdk: flutter


  # The following adds the Cupertino Icons font to your application.
  # Use with the CupertinoIcons class for iOS style icons.
  cupertino_icons: ^1.0.5
  flutter_chat_ui: ^1.6.6
  web_socket_channel: ^2.2.0
  uuid: ^3.0.6
  http: ^0.13.5
  firebase_core: ^2.2.0
  firebase_messaging: ^14.1.0
  hive: ^2.2.3
  hive_flutter: ^1.1.0
  url_launcher: ^6.1.6
  badges: ^2.0.3
  yaml: ^3.1.1
  pointycastle: ^3.6.2
  asn1lib: ^1.2.2
  image_picker: ^0.8.6
  permission_handler: ^10.2.0
  image_cropper: ^3.0.1
  flutter_email_sender: ^5.1.0
  path_provider: ^2.0.11

[SvenWesterlaken]

Maybe something with encoding? Mine is working fine with given header properties:

await http.get(<url>, headers: {
  HttpHeaders.authorizationHeader: 'Bearer ${pref.getString('jwt')}'
})

[dromerolovo]

@AdrKacz

I'm having the same issue.

The GET request works fine in Postman. But when I make the get request with flutter

    final response = await _client.get(
        Uri.parse(<url>),
        headers: <String, String>{
            'Authorization: 'ClientToken $token',
            'Content-Type': 'application/json'
        });

The log of the server shows that the Authorization header is missing. I can even add another header like 'RandomHeader':'RandomValue' and the log of the server will show that header but not Authorization

So something along the way is blocking the Authorization header. I'm running the flutter app on an android platform. So far my solution have been to add a fallback header and getting the value of that header if the server don't find any Authorization header. But it's not an ideal solution.

Have you got any insights regarding this?

[SvenWesterlaken]

Looks like you're missing a closing qoute after Authorization @dromerolovo

[dromerolovo]

@SvenWesterlaken Might be something that went wrong while trying to format manually, but it is not working with quotes. I'll make a minimal reproducible example.

[sumanthratna]

Any tips here? I'm facing this issue and it's a big blocker for me.

I'm creating a client using CupertinoClient.defaultSessionConfiguration() and making a simple GET request with content-type and authorization, but authorization is being stripped from the request.

[dromerolovo]

@sumanthratna I don't remember how I fixed this, can you paste a snippet of your code

[sumanthratna]

@dromerolovo thanks for offering to help. I just found out that it's because I was hitting an endpoint /api/endpoint, which returned a 301 redirect to /api/endpoint/.

In this case, http.Client does not strip the Authorization header, while CupertinoClient does.

[brianquinlan]

I think that NSURLRequest is stripping the Authorization header.

It would be possible for CupertinoClient to work around this issue but only for foreground requests.