From ffc7ce55a353710d4cfe8fa21f9f9c4d56acb5fc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Krier?= Date: Mon, 8 May 2023 13:21:10 +0200 Subject: [PATCH] Parse authorization header for session scheme without token Since Werkzeug >= 2.3, it always tries to parse the Authorization header as a digest. If the session value which is encoded in base64 needs padding, the trailing `=` are interpreted as header values and the token attribute is not filled. In this case we must parse ourself the Authorization header to decode the base64 value as session. Closes #12259 --- trytond/trytond/protocols/wrappers.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/trytond/trytond/protocols/wrappers.py b/trytond/trytond/protocols/wrappers.py index 269598c50c..0d11ce2e43 100644 --- a/trytond/trytond/protocols/wrappers.py +++ b/trytond/trytond/protocols/wrappers.py @@ -95,7 +95,13 @@ class Request(_Request): header = self.headers.get('Authorization') return parse_authorization_header(header) elif authorization.type == 'session': - return parse_session(authorization.token) + # Werkzeug may parse the session as parameters + # if the base64 uses the padding sign '=' + if authorization.token is None: + header = self.headers.get('Authorization') + return parse_authorization_header(header) + else: + return parse_session(authorization.token) return authorization @cached_property