Extracts the Payment scheme from a header value that may carry several
schemes comma-separated (RFC 9110 §11.6.1).
The Payment scheme takes one of two shapes on our wire: a bare token68
credential (Payment <base64url>, which cannot itself contain a comma or
a quote) or a structured challenge (Payment id="...", realm="...", ...,
comma-separated key="value" auth-params, where a value MAY contain a
comma). Bounding the match at the next literal "Payment " occurrence — or
at end-of-string otherwise — corrupts the first shape whenever a
different trailing scheme follows: e.g. Payment <token>, Bearer <jwt>
used to extract the whole remainder including the trailing scheme.
Bounding a structured challenge with a naive, quote-unaware comma split
corrupts the second shape whenever a value contains a comma: it truncates
mid-quote and silently drops every param after it. Instead: a bare
token68 is bounded by its first top-level comma; a structured challenge is
bounded by findStructuredChallengeEnd's quote-aware scan.
Extracts the
Paymentscheme from a header value that may carry several schemes comma-separated (RFC 9110 §11.6.1).The
Paymentscheme takes one of two shapes on our wire: a bare token68 credential (Payment <base64url>, which cannot itself contain a comma or a quote) or a structured challenge (Payment id="...", realm="...", ..., comma-separatedkey="value"auth-params, where a value MAY contain a comma). Bounding the match at the next literal "Payment " occurrence — or at end-of-string otherwise — corrupts the first shape whenever a different trailing scheme follows: e.g.Payment <token>, Bearer <jwt>used to extract the whole remainder including the trailing scheme. Bounding a structured challenge with a naive, quote-unaware comma split corrupts the second shape whenever a value contains a comma: it truncates mid-quote and silently drops every param after it. Instead: a bare token68 is bounded by its first top-level comma; a structured challenge is bounded by findStructuredChallengeEnd's quote-aware scan.