Fix #28038: Reject multiple Authorization headers with 400 Bad Request

components/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/context/valve/IdentityContextCreatorValve.java

@@ -28,8 +28,10 @@
 import org.wso2.carbon.identity.core.internal.context.OrganizationResolver;
 
 import java.io.IOException;
+import java.util.Enumeration;
 
 import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletResponse;
 
 public class IdentityContextCreatorValve extends ValveBase {
 
@@ -47,6 +49,19 @@ public IdentityContextCreatorValve() {
     @Override
     public void invoke(Request request, Response response) throws IOException, ServletException {
 
+        Enumeration<String> authHeaders = request.getHeaders("Authorization");
+        if (authHeaders != null) {
+            int authHeaderCount = 0;
+            while (authHeaders.hasMoreElements()) {
+                authHeaders.nextElement();
+                authHeaderCount++;
+                if (authHeaderCount > 1) {
+                    response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Multiple Authorization headers are not allowed.");
+                    return;
+                }
+            }
+        }
+
         try {
             initIdentityContext();
             initRequest(request);