diff --git a/.github/scripts/test-program.sh b/.github/scripts/test-program.sh
index 2073211..7a275d8 100644
--- a/.github/scripts/test-program.sh
+++ b/.github/scripts/test-program.sh
@@ -70,6 +70,37 @@ else
     fail "curl response did not contain expected content (got: $RESPONSE)"
 fi
 
+# Setup Auth in config
+echo "AUTH_USER=admin" >> test-env.cfg
+echo "AUTH_PASSWORD=password123" >> test-env.cfg
+echo "AUTH_REALM=TestRealm" >> test-env.cfg
+
+kill "$SERVER_PID" 2>/dev/null
+./program -e test-env.cfg > /dev/null 2>&1 &
+SERVER_PID=$!
+sleep 1
+
+# test 5
+echo ">> Testing unauthorized access (expecting 401)..."
+HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" localhost:8080)
+
+if [ "$HTTP_STATUS" -eq 401 ]; then
+    pass "Correctly returned 401 Unauthorized"
+else
+    fail "Expected 401, but got $HTTP_STATUS"
+fi
+
+# test 6
+echo ">> Testing authorized access (expecting 200)..."
+# Using -u for Basic Auth
+HTTP_STATUS=$(curl -s -u admin:password123 -o /dev/null -w "%{http_code}" localhost:8080)
+
+if [ "$HTTP_STATUS" -eq 200 ]; then
+    pass "Correctly returned 200 OK with valid credentials"
+else
+    fail "Expected 200, but got $HTTP_STATUS"
+fi
+
 # summary
 echo ""
 echo "================================"
diff --git a/macros/httputils.asm b/macros/httputils.asm
index a0ef289..a97aa52 100644
--- a/macros/httputils.asm
+++ b/macros/httputils.asm
@@ -366,23 +366,23 @@ section .bss
     xor r8, r8      ; offset
 
 %%auth_scan:
-    ; need at least 22 bytes left: "Authorization: Basic " (21) + 1 byte of token
+    ; need at least 22 bytes left: "authorization: Basic " (21) + 1 byte of token
     mov rax, r8
     add rax, 22
     cmp rax, %2
     jg %%not_found
 
-    cmp byte [rsi + r8], 'A'
+    cmp byte [rsi + r8], 'a'
     jne %%auth_next
 
-    ; "Authorization: Basic " split into dwords:
-    ;   [+0]  "Auth" = 0x68747541
+    ; "authorization: Basic " split into dwords:
+    ;   [+0]  "auth" = 0x68747561
     ;   [+4]  "oriz" = 0x7a69726f
     ;   [+8]  "atio" = 0x6f697461
     ;   [+12] "n: B" = 0x42203a6e
     ;   [+16] "asic" = 0x63697361
-    ;   [+20] " "   = 0x20
-    cmp dword [rsi + r8 +  0], 0x68747541
+    ;   [+20] " "    = 0x20
+    cmp dword [rsi + r8 +  0], 0x68747561
     jne %%auth_next
 
     cmp dword [rsi + r8 +  4], 0x7a69726f