Merge pull request #23920 from nextcloud/fix/match_bearer_front

Bearer must be in the start of the auth header
nextcloud · Nov 6, 2020 · 2c6bbe7 · 2c6bbe7
2 parents 9feacee + e93823c
commit 2c6bbe7
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php
@@ -814,15 +814,15 @@ private function validateToken($token, $user = null) {
 	 */
 	public function tryTokenLogin(IRequest $request) {
 		$authHeader = $request->getHeader('Authorization');
-		if (strpos($authHeader, 'Bearer ') === false) {
+		if (strpos($authHeader, 'Bearer ') === 0) {
+			$token = substr($authHeader, 7);
+		} else {
 			// No auth header, let's try session id
 			try {
 				$token = $this->session->getId();
 			} catch (SessionNotAvailableException $ex) {
 				return false;
 			}
-		} else {
-			$token = substr($authHeader, 7);
 		}
 
 		if (!$this->loginWithToken($token)) {