Description
Construct fake Bearer header casing and whitespace variants with malformed-token controls and delegated extraction answers.
A protocol fixture is local test data representing headers, messages, identifiers, or request decisions. Serialization and parsing can be checked without contacting a server, while authentication, delivery, and actual client behavior require separate tests.
Construct fake Bearer header casing and whitespace variants with malformed-token controls and delegated extraction answers.
When to use this tool
Use this generator to create reproducible http bearer shape corpus cases from the supplied model or bank. Inspect the returned evidence before using cases in a test or exercise.
How to use the tool and how it works
- Supply tokens, styles, count in the field shapes below. Set seed when you need an explicit replay.
- Run the tool and correct any input error. For generated controls, distinguish a successful fixture containing an invalid case from failure to generate the fixture.
- Read cases. Use the conventions below and keep answer-bearing fields separate when presenting an exercise.
Choose token-shaped supplied strings and canonical, lowercase-scheme, padded, or illegal-space authorization spellings. Delegate Bearer extraction, preserving accepted token or the actual issue code.1
Delegated operations used for this result: bearer extractor. Their calculation or parsing conventions apply to the corresponding result fields.2
| Input field | Meaning and units | Accepted input |
|---|---|---|
| tokens | Tokens | Required. Array of Text; maximum UTF-16 length 65536.; minimum items 1; maximum items 16. |
| styles | Styles | Required. Array of Text; one of "plain", "lower", "padded", "invalid-space".; minimum items 1; maximum items 4. |
| count | Requested count; the mechanics explain whether one draw expands into several returned records. | Required. Safe integer; minimum 1; maximum 32. |
| seed | Optional numeric seed; takes precedence over context randomness. Without either, use the fixed tool.io default seed. | Optional. Safe integer. |
| Output field | Interpretation | Returned shape |
|---|---|---|
| cases | Cases | Required. Array of Object; no unknown keys.; minimum items 1; maximum items 32. |
| cases[].authorization | Authorization | Required. Text; maximum UTF-16 length 65536. |
| cases[].style | Style | Required. Text; maximum UTF-16 length 65536. |
| cases[].accepted | Accepted | Required. Boolean. |
| cases[].token | Token | Required. Text; maximum UTF-16 length 65536. |
| cases[].errorCode | Error Code | Required. Text; maximum UTF-16 length 65536. |
| randomness | Replay metadata: source is seed or context; seed is the normalized 32-bit seed or null for a context source. | Required. Object; no unknown keys. |
| randomness.seed | Optional numeric replay seed; normalization and precedence are explained below. | Required. Safe integer. or Null. |
| randomness.source | Source | Required. Text; one of "context", "seed". |
An explicit safe-integer seed takes precedence over injected context randomness and is normalized to an unsigned 32-bit integer. With no seed and no context source, replay uses the fixed tool.io default seed. A context source must return finite values from zero inclusive to one exclusive; its advancing state must be retained separately. randomness records the source and normalized seed, or null for context. These generators are not cryptographic random sources.
{
"input": {
"tokens": [
"fake-1",
"fake-2._~"
],
"styles": [
"plain"
],
"count": 1,
"seed": 42
},
"output": {
"cases": [
{
"authorization": "Bearer fake-2._~",
"style": "plain",
"accepted": true,
"token": "fake-2._~",
"errorCode": ""
}
],
"randomness": {
"seed": 42,
"source": "seed"
}
}
}Limitations and assumptions
- Token shape does not authenticate credentials or validate signature, expiry, scope, issuer, or audience. All supplied strings are fixtures and no authorization header is sent.
- A replay requires the same complete input and implementation. Randomized construction does not guarantee uniform coverage of every feasible output; finite samples can repeat unless a distinct-selection rule is explicitly stated.
- The field tables state structural bounds; cross-field constraints and bounded search or output budgets also apply. Unknown keys are rejected where the object contract disallows them. Input errors are distinct from null fields and deliberate invalid controls in a successful output.
Alternative or Complementary methods
For a supplied example, inspect the returned construction or delegated check directly. To evaluate a consumer, also test cases chosen for its own boundaries; a generated finite corpus does not establish exhaustive coverage.
References
Similar or alternative tools
- Random HTTP Basic Auth Parser Corpus Generator
Construct synthetic ASCII Basic credential bytes and malformed controls, preserving delegated split and error outcomes without real credentials.
- Random HTTP Conditional Request Fixture Generator
Construct single-tag conditional requests with explicit existence and epoch-second date inputs, applying tag-before-date precedence and GET/HEAD response decisions.