WebSocket JWT auth uses incorrect header name

When using JWT authentication on a WebSocket request, the token is sent in a “token” header instead of the default “Authorization” header, despite the UI stating otherwise.

Steps to reproduce:

• Run any WebSocket server on localhost:8000.

• Create a new WebSocket request. Set URL to “ws://127.0.0.1:8000/”.

• Select JWT Bearer authentication method.

• Open Wireshark (since WebSockets don’t go through the configured proxy).

• Send the request.

• Observe the HTTP request in Wireshark with a “token” header, instead of the “Authorization” header, as implied by the UI.

The “Header Name” field in Advanced JWT options shows “Authorization” but is actually sent as “token”. Interestingly, clearing that field and setting it again fixes the problem.

The attached images show the request in Yaak, as well as its result in Wireshark.