Match Exactly

Honesty Boundary

The toy Bearer token example keeps its boundary narrow.

highlighted = computed this step

What this toy model checks

The trust boundary parses one GET request, one Bearer Authorization header, one allow-list row, one empty response, and the exact match checks.

recompute Bearer rows\text{recompute Bearer rows}
Bearer honesty boundaryThe exact token compare, selected user display, and empty response body are recomputed from pinned bytes.Bearer honesty boundary - Bearer token matches allow-list user adasectionnamevaluecheckrequest linemethodGETparsedrequest linepath/profileparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBearerparsedheaderAuthorization tokentok_7aopaque tokentokendisplaytok_7aopaquetokenexact hex746f6b5f3761pinned bytesallow-listtokentok_7astoredallow-listuser displayadaselectedallow-listmatchyesexact comparestatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBearerBearerchecktoken matchyesexactcheckselected useradaallow-listchecksent body bytes0empty

Honesty boundary

NOTE: toy HTTP Bearer token check only; not JWTs, OAuth flows, token signing, expiration, scopes, refresh tokens, TLS, cookies, CSRF, revocation, storage, logging, replay protection, rate limits, HTTP/2 or HTTP/3, frameworks, or production auth config.

toy Bearer token only\text{toy Bearer token only}
Bearer honesty boundaryThe exact token compare, selected user display, and empty response body are recomputed from pinned bytes.Bearer honesty boundary - Bearer token matches allow-list user adasectionnamevaluecheckrequest linemethodGETparsedrequest linepath/profileparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBearerparsedheaderAuthorization tokentok_7aopaque tokentokendisplaytok_7aopaquetokenexact hex746f6b5f3761pinned bytesallow-listtokentok_7astoredallow-listuser displayadaselectedallow-listmatchyesexact comparestatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBearerBearerchecktoken matchyesexactcheckselected useradaallow-listchecksent body bytes0empty

No client compute

The page shows already validated rows. It does not compare auth tokens in browser code.

static validated rows\text{static validated rows}
Bearer honesty boundaryThe exact token compare, selected user display, and empty response body are recomputed from pinned bytes.Bearer honesty boundary - Bearer token matches allow-list user adasectionnamevaluecheckrequest linemethodGETparsedrequest linepath/profileparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBearerparsedheaderAuthorization tokentok_7aopaque tokentokendisplaytok_7aopaquetokenexact hex746f6b5f3761pinned bytesallow-listtokentok_7astoredallow-listuser displayadaselectedallow-listmatchyesexact comparestatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBearerBearerchecktoken matchyesexactcheckselected useradaallow-listchecksent body bytes0empty

Summary

A Bearer token can be opaque: this toy server accepts it only by exact match.

opaque token matched\text{opaque token matched}
Bearer honesty boundaryThe exact token compare, selected user display, and empty response body are recomputed from pinned bytes.Bearer honesty boundary - Bearer token matches allow-list user adasectionnamevaluecheckrequest linemethodGETparsedrequest linepath/profileparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBearerparsedheaderAuthorization tokentok_7aopaque tokentokendisplaytok_7aopaquetokenexact hex746f6b5f3761pinned bytesallow-listtokentok_7astoredallow-listuser displayadaselectedallow-listmatchyesexact comparestatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBearerBearerchecktoken matchyesexactcheckselected useradaallow-listchecksent body bytes0empty