From 3f5565bcc73368f3469294d4569a9988bcc4c7bf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Krier?= Date: Mon, 8 May 2023 13:21:10 +0200 Subject: [PATCH] Parse authorization header for session scheme without token Since Werkzeug >= 2.3, it always tries to parse the Authorization header as a digest. If the session value which is encoded in base64 needs padding, the trailing `=` are interpreted as header values and the token attribute is not filled. In this case we must parse ourself the Authorization header to decode the base64 value as session. Closes #12259 (grafted from 0bd0b8a0e20ad8d2f3d13cc8d879c78717817b7a) --HG-- branch : 6.0 --- trytond/trytond/protocols/wrappers.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/trytond/trytond/protocols/wrappers.py b/trytond/trytond/protocols/wrappers.py index 42dbbf28bc..68933f01c2 100644 --- a/trytond/trytond/protocols/wrappers.py +++ b/trytond/trytond/protocols/wrappers.py @@ -77,7 +77,13 @@ class Request(_Request): header = self.headers.get('Authorization') return parse_authorization_header(header) elif authorization.type == 'session': - return parse_session(authorization.token) + # Werkzeug may parse the session as parameters + # if the base64 uses the padding sign '=' + if authorization.token is None: + header = self.headers.get('Authorization') + return parse_authorization_header(header) + else: + return parse_session(authorization.token) return authorization @cached_property