From 48e5b5e8c316e6ab48c319dba1faceba1e53f36a Mon Sep 17 00:00:00 2001
From: lprnmns <manasalperen@gmail.com>
Date: Sat, 29 Aug 2026 13:00:20 +0300
Subject: [PATCH] fix: reject empty bearer tokens

Signed-off-by: lprnmns <manasalperen@gmail.com>
---
 index.js                             |  2 +-
 test/malformed-authorization.test.js | 29 ++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 test/malformed-authorization.test.js

diff --git a/index.js b/index.js
index 486c3bb..f1ebe1d 100644
--- a/index.js
+++ b/index.js
@@ -257,7 +257,7 @@ function fastifyJwt (fastify, options, next) {
       }
     } else if (request.headers.authorization && !onlyCookie && /^Bearer\s/i.test(request.headers.authorization)) {
       const parts = request.headers.authorization.split(' ')
-      if (parts.length === 2) {
+      if (parts.length === 2 && parts[1]) {
         token = parts[1]
       } else {
         throw new BadRequestError()
diff --git a/test/malformed-authorization.test.js b/test/malformed-authorization.test.js
new file mode 100644
index 0000000..d9363b5
--- /dev/null
+++ b/test/malformed-authorization.test.js
@@ -0,0 +1,29 @@
+'use strict'
+
+const { test } = require('node:test')
+const Fastify = require('fastify')
+const jwt = require('..')
+
+test('empty Bearer token returns a bad request', async function (t) {
+  const fastify = Fastify()
+  fastify.register(jwt, { secret: 'test' })
+  fastify.get('/', function (request) {
+    return request.jwtVerify()
+  })
+
+  await fastify.ready()
+
+  const response = await fastify.inject({
+    method: 'GET',
+    url: '/',
+    headers: {
+      authorization: 'Bearer '
+    }
+  })
+
+  t.assert.strictEqual(response.statusCode, 400)
+  t.assert.strictEqual(response.json().code, 'FST_JWT_BAD_REQUEST')
+  t.assert.strictEqual(response.json().message, 'Format is Authorization: Bearer [token]')
+
+  await fastify.close()
+})