From 010a38b61f52bf8f4b78bc647a73e59bae108a31 Mon Sep 17 00:00:00 2001 From: Jonathan Haas Date: Mon, 13 Jul 2026 15:19:20 -0700 Subject: [PATCH] fix(identityclient): use bearer bootstrap authorization --- identityclient/client.go | 2 +- identityclient/client_test.go | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/identityclient/client.go b/identityclient/client.go index 5130d7b..3644295 100644 --- a/identityclient/client.go +++ b/identityclient/client.go @@ -327,7 +327,7 @@ func (c *Client) IssueServiceToken( } request.Header.Set("Content-Type", "application/json") if strings.TrimSpace(c.bootstrapKey) != "" { - request.Header.Set("X-Identity-Bootstrap-Key", c.bootstrapKey) + request.Header.Set("Authorization", "Bearer "+c.bootstrapKey) } response, err := c.httpClient.Do(request) diff --git a/identityclient/client_test.go b/identityclient/client_test.go index 552f70e..ae3f806 100644 --- a/identityclient/client_test.go +++ b/identityclient/client_test.go @@ -451,6 +451,12 @@ func TestResolveServiceTokenIssuesAndCachesByScopeSet(t *testing.T) { var identityCalls atomic.Int32 identityServer := testutil.NewTestServer(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { identityCalls.Add(1) + if got := r.Header.Get("Authorization"); got != "Bearer identity-bootstrap-key" { + t.Fatalf("expected bearer bootstrap authorization, got %q", got) + } + if got := r.Header.Get("X-Identity-Bootstrap-Key"); got != "" { + t.Fatalf("expected legacy bootstrap header to be absent, got %q", got) + } testutil.WriteJSON(t, w, http.StatusCreated, map[string]any{ "token": "identity-service-token", "token_type": "Bearer", @@ -553,6 +559,9 @@ func TestIssueServiceTokenAllowsMTLSWithoutBootstrapKey(t *testing.T) { t.Parallel() identityServer := testutil.NewTestServer(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if got := r.Header.Get("Authorization"); got != "" { + t.Fatalf("expected no authorization header without a bootstrap key, got %q", got) + } if got := r.Header.Get("X-Identity-Bootstrap-Key"); got != "" { t.Fatalf("expected no bootstrap key header, got %q", got) }