Expected Behavior

isAjax in oauthproxy.go should be iterating through different mime types for the Accept: field and return true if application/json is found.

Current Behavior

isAjax iterates over a single string. If this string matches application/json exactly, isAjax works as intended. With multiple mime types, as allowed by standards and default for Axios, isAjax fails to find the correct mime type. The following test fails, proving the point.

func TestAjaxUnauthorizedRequestAccept1(t *testing.T) {
	header := make(http.Header)
	header.Add("Accept", "application/json, text/plain, */*")

	testAjaxUnauthorizedRequest(t, header)
}

Possible Solution

Fix the loop to actually iterate over multiple mime types.