allow ticket in auth header as fallback

based on idea & RFC by Tim Marx, incorporating feedback by Thomas
Lamprecht. this will be extended to support API tokens in the
Authorization header as well, so make it generic.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>

diff --git a/PVE/APIServer/AnyEvent.pm b/PVE/APIServer/AnyEvent.pm
index 539a15616c6c409005969f462d9881a74ba63254..1e5c1807493b83a75e0aee39320267252f0edd68 100644 (file)
--- a/PVE/APIServer/AnyEvent.pm
+++ b/PVE/APIServer/AnyEvent.pm
@@ -1229,7 +1229,14 @@ sub unshift_read_header {
                } elsif ($path =~ m/^\Q$base_uri\E/) {
                    my $token = $r->header('CSRFPreventionToken');
                    my $cookie = $r->header('Cookie');
-                   my $ticket = PVE::APIServer::Formatter::extract_auth_cookie($cookie, $self->{cookie_name});
+                   my $auth_header = $r->header('Authorization');
+
+                   # prefer actual cookie
+                   my $ticket = PVE::APIServer::Formatter::extract_auth_value($cookie, $self->{cookie_name});
+
+                   # fallback to cookie in 'Authorization' header
+                   $ticket = PVE::APIServer::Formatter::extract_auth_value($auth_header, $self->{cookie_name})
+                       if !$ticket;
 
                    my ($rel_uri, $format) = &$split_abs_uri($path, $self->{base_uri});
                    if (!$format) {

diff --git a/PVE/APIServer/Formatter.pm b/PVE/APIServer/Formatter.pm
index 0c459bdc95fb2125cfc26e4ecb16f20ae90c0193..def19328d019721c2c5ac3b753707b3b557b6de7 100644 (file)
--- a/PVE/APIServer/Formatter.pm
+++ b/PVE/APIServer/Formatter.pm
@@ -75,16 +75,16 @@ sub get_login_formatter {
 
 # some helper functions
 
-sub extract_auth_cookie {
-    my ($cookie, $cookie_name) = @_;
+sub extract_auth_value {
+    my ($header, $key) = @_;
 
-    return undef if !$cookie;
+    return undef if !$header;
 
-    my $ticket = ($cookie =~ /(?:^|\s)\Q$cookie_name\E=([^;]*)/)[0];
+    my $value = ($header =~ /(?:^|\s)\Q$key\E(?:=| )([^;]*)/)[0];
 
-    $ticket = uri_unescape($ticket) if $ticket;
+    $value = uri_unescape($value) if $value;
 
-    return $ticket;
+    return $value;
 }
 
 sub create_auth_cookie {