Why is FindRolesWithinJWTClaims looking for a "Authorization" header in responses?

[ngregoire]

I'm surprised to see that this bambda is looking for a Authorization header in responses. Maybe that exists, but it seems quite uncommon to send back a JWT that way.

Here's my own version, looking for JWT in request header Authorization

if (requestResponse.hasResponse() && requestResponse.request().hasHeader("authorization")) {
    var authValue = requestResponse.request().headerValue("authorization");
    if (authValue.startsWith("Bearer ey")) {
        if (authValue.split("\\.").length == 3) {
           return true;
        }
    }
}
return false;

[PortSwiggerWiener]

Agreed. I've removed it.