Parse authorization header for session scheme without token
Since Werkzeug >= 2.3, it always tries to parse the Authorization header as a digest. If the session value which is encoded in base64 needs padding, the trailing `=` are interpreted as header values and the token attribute is not filled. In this case we must parse ourself the Authorization header to decode the base64 value as session. Closes #12259
This commit is contained in:
1 parent
b68a8d6598
commit
ffc7ce55a3
1 file changed
+7
-1
@@ -95,7 +95,13 @@ class Request(_Request):
|
||||
header = self.headers.get('Authorization')
|
||||
return parse_authorization_header(header)
|
||||
elif authorization.type == 'session':
|
||||
return parse_session(authorization.token)
|
||||
# Werkzeug may parse the session as parameters
|
||||
# if the base64 uses the padding sign '='
|
||||
if authorization.token is None:
|
||||
header = self.headers.get('Authorization')
|
||||
return parse_authorization_header(header)
|
||||
else:
|
||||
return parse_session(authorization.token)
|
||||
return authorization
|
||||
|
||||
@cached_property
|
||||
|
||||
Reference in new issue
Block a user