Add the feature to check the authorization header

[kyeongsoosoo]

Summary

I added the feature that checks the Authorization header.
I implemented this feature to test this PR

[mattermost-build]

Hello @kyeongsoosoo,

Thanks for your pull request! A Core Committer will review your pull request soon. For code contributions, you can learn more about the review process here.

[codecov-commenter]

Codecov Report

Attention: 14 lines in your changes are missing coverage. Please review.

Comparison is base (f006ddc) 2.90% compared to head (88d5846) 2.93%.

Additional details and impacted files

@@            Coverage Diff            @@
##           master    #170      +/-   ##
=========================================
+ Coverage    2.90%   2.93%   +0.03%     
=========================================
  Files          14      14              
  Lines        1823    1838      +15     
=========================================
+ Hits           53      54       +1     
- Misses       1768    1782      +14     
  Partials        2       2              

Files	Coverage Δ
server/http_hooks.go	11.60% <6.66%> (-0.24%)	⬇️

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[hanzei]

Thanks @kyeongsoosoo 👍

[mickmister]

I've tested this with a few different permutations, and it looks good other than one thing that seems odd to me:

$ ./authenticated-with-cookie
You are an authenticated user. The Authorization header should be an empty string.
Authorization header: 

$ ./authenticated-with-cookie-and-custom-header 
Authorization header: Bearer CustomToken

$ ./authenticated-with-cookie-and-mm-header 
You are an authenticated user. The Authorization header should be an empty string.
Authorization header: 

$ ./authenticated-with-mm-header-and-without-cookie 
You are an authenticated user. The Authorization header should be an empty string.
Authorization header: 

$ ./unauthenticated-with-custom-header 
Authorization header: Bearer MyToken

$ ./unauthenticated-without-header 
Authorization header:

This is more of an observation than anything - For the authenticated-with-cookie-and-custom-header run, it seems the server does not check the cookie in the case of a Authorization header value being present. This seems harmless, though I originally expected the request to be authenticated since the cookie provided is valid.

@hanzei What do you think? I'm thinking this and mattermost/mattermost#24391 are good to merge as is.

[hanzei]

@kyeongsoosoo Heads up that there is conflict to resolve

[kyeongsoosoo]

@kyeongsoosoo Heads up that there is conflict to resolve

@hanzei Conflicts resolved :)

[kyeongsoosoo]

Passing the plugin.Context to the handler became difficult, so I switched to using the Mattermost-User-Id in the request header instead of the context's SessionId.

[mickmister]

@hanzei Do you think this is good to merge based on my comment above?

[hanzei]

Yep, I think we are good the merge both PRs.

cc @DHaussermann