"Basic" authentication scheme name should be case insenstive

[jeroenheijmans]

In an issue in a client side OAuth2 framework (angular-oauth2-oidc) it was noted that Spring Security does a case sensitive comparison (I think, in this line) for the string "Basic ".

I'm unsure if I referred to the correct RFC, but in RFC 7617 section 2 it is noted that the scheme name should be matched case insensitively (even though all examples use "Basic" as the spelling).

Just for reference (and to double check my hunch), IdentityServer4 (from the .NET ecosystem) seems to do it case insensitively.

Perhaps someone more knowledgeable than I can double check my thoughts, but if I'm right then I think it would be good to make the check ignore case in Spring Security too.

[rwinch]

Thanks for the report! A fix is now in master, 5.0.x, and 4.2.x