Incident Dossier

Lowercase header lookup

The auth gateway denies legitimate requests whenever an upstream proxy rewrites the `Authorization` header to `authorization`. The middleware cannot find the token, fails closed, and the customer sees a 401. The header value is correct; the lookup is case-sensitive.

Initial failing signalAuthorization lookup fails when key is 'Authorization'Expected behavior: getHeader({Authorization: ...}, 'authorization') returns the value · actual behavior: returns undefined

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Inspect the failing assertion about case-insensitive header lookup.
Trace the getHeader helper and how it indexes the headers object.
Normalize both sides of the comparison.

Focus Mode

Start

src/http.js

Likely area

src/http.js

Challenge Coach

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicHTTP/API

DifficultyMedium

Est. time16 min

Workspacepreparing

Explorer

Loading files

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ prepare workspace

Preparing workspace