fix(auth): guard JWTHandler.is_jwt() against None token

When JWT auth is enabled and a request arrives without an Authorization
header (e.g. health checks, monitoring), api_key is None due to
APIKeyHeader(auto_error=False). The is_jwt() call crashes with
AttributeError: 'NoneType' object has no attribute 'split'.

Return False for None tokens since they are not JWTs.
This commit is contained in:
Ryan Crabbe 2026-03-27 16:26:00 -07:00
parent 8f425ec3ff
commit e36ab04a18
No known key found for this signature in database

View file

@ -89,7 +89,9 @@ class JWTHandler:
self.leeway = leeway
@staticmethod
def is_jwt(token: str):
def is_jwt(token: Optional[str]):
if token is None:
return False
parts = token.split(".")
return len(parts) == 3