[Bug report] Forward Auth fails unless identity header names are lowercase

[fscheps]

GitHub Issues are currently disabled for this repository, so I am reporting this confirmed bug in Discussions.

What Went Wrong?

Forward Auth in BookLore v2.3.1 fails when an HTTP/1.1 reverse proxy sends configured identity headers using normal canonical or mixed casing.

AuthenticationController.loginRemote() receives the headers as a Map<String, String>, lowercases each configured header name, and then performs a case-sensitive map lookup:

String username = headers.get(appProperties.getRemoteAuth().getHeaderUser().toLowerCase(Locale.ROOT));

When a proxy sends X-Booklore-User, the request-header map retains that casing, but BookLore looks up x-booklore-user. The result is null, and /api/v1/auth/remote returns HTTP 400 with Remote-User header is missing.

HTTP field names are case-insensitive, so authentication should not depend on their wire casing. The same implementation is still present on the current develop branch.

How Can We Reproduce This?

1. Run BookLore v2.3.1 with Forward Auth enabled:

   REMOTE_AUTH_ENABLED=true
   REMOTE_AUTH_CREATE_NEW_USERS=true
   REMOTE_AUTH_HEADER_USER=X-BookLore-User
   REMOTE_AUTH_HEADER_NAME=X-BookLore-Name
   REMOTE_AUTH_HEADER_EMAIL=X-BookLore-Email
   

2. Place BookLore behind an HTTP/1.1 reverse proxy.

3. Have the proxy send normally canonicalized headers:

   X-Booklore-User: test-user
   X-Booklore-Name: Test User
   X-Booklore-Email: test@example.invalid

4. Request GET /api/v1/auth/remote.

5. BookLore returns HTTP 400. Controller debug output reports all retrieved identity values as null.

6. Repeat with the same header names entirely lowercase on the wire:

   x-booklore-user: test-user
   x-booklore-name: Test User
   x-booklore-email: test@example.invalid

7. Remote authentication succeeds.

This was also isolated with a raw HTTP/1.1 request: a lowercase diagnostic email header was visible to AuthenticationController, while the same normally canonicalized header was null.

Expected Behavior

BookLore should resolve configured Forward Auth headers case-insensitively, regardless of whether a proxy emits lowercase, Title-Case, or other valid mixed casing.

Sanitized Error Evidence

Remote-Auth: retrieved values from headers: name: null, username: null, email: null, groups: null

{"message":"Remote-User header is missing","status":400}

Suggested Fix

Use a case-insensitive header abstraction rather than lowercasing a key and looking it up in a potentially case-sensitive Map. For example, accept Spring HttpHeaders and use getFirst(configuredHeaderName), or use another explicitly case-insensitive lookup.

Please add controller tests covering lowercase, canonical Title-Case, and arbitrary mixed-case header names for user, name, email, and groups.

Environment

• BookLore: v2.3.1
• OS: Ubuntu Linux
• Browser: Browser-independent; reproduced at the HTTP API layer
• Installation: Docker Compose
• Reverse proxy: Go net/http, HTTP/1.1 upstream
• Storage: Local SSD

I searched existing reports. Related but distinct: PR #3078 handles Authorization-header casing in the Kobo proxy path; this report concerns Forward Auth header lookup in AuthenticationController.