Parse authorization header for session scheme without token

Since Werkzeug >= 2.3, it always tries to parse the Authorization header as a
digest. If the session value which is encoded in base64 needs padding, the
trailing `=` are interpreted as header values and the token attribute is not
filled.
In this case we must parse ourself the Authorization header to decode the
base64 value as session.

Closes #12259
This commit is contained in:
Cédric Krier committed 2023-05-08 13:21:10 +02:00
1 parent b68a8d6598
commit ffc7ce55a3
1 file changed
+7 -1
+7 -1
View File
@@ -95,7 +95,13 @@ class Request(_Request):
header = self.headers.get('Authorization')
return parse_authorization_header(header)
elif authorization.type == 'session':
return parse_session(authorization.token)
# Werkzeug may parse the session as parameters
# if the base64 uses the padding sign '='
if authorization.token is None:
header = self.headers.get('Authorization')
return parse_authorization_header(header)
else:
return parse_session(authorization.token)
return authorization
@cached_property