From 75f0aaeee9645f009c917772c93373a8e240da9f Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Thu, 8 Jun 2023 11:30:32 -0400 Subject: [PATCH] Allow session id through header This permits a client to exert finer grained control over the session id than provided by cookie. --- confluent_server/confluent/httpapi.py | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/confluent_server/confluent/httpapi.py b/confluent_server/confluent/httpapi.py index 5ae8811f..ecb1d23b 100644 --- a/confluent_server/confluent/httpapi.py +++ b/confluent_server/confluent/httpapi.py @@ -288,12 +288,16 @@ def _authorize_request(env, operation, reqbody): authdata = auth.authorize(name, element=element, operation=operation) else: element = None - if (not authdata) and 'HTTP_COOKIE' in env: - cidx = (env['HTTP_COOKIE']).find('confluentsessionid=') - if cidx >= 0: - sessionid = env['HTTP_COOKIE'][cidx+19:cidx+51] - sessid = sessionid + if not authdata: + if 'HTTP_CONFLUENTSESSION' in env: + sessionid = env['HTTP_CONFLUENTSESSION'] sessid = sessionid + elif 'HTTP_COOKIE' in env: + cidx = (env['HTTP_COOKIE']).find('confluentsessionid=') + if cidx >= 0: + sessionid = env['HTTP_COOKIE'][cidx+19:cidx+51] + sessid = sessionid + if sessionid: if sessionid in httpsessions: if _csrf_valid(env, httpsessions[sessionid]): if env['PATH_INFO'] == '/sessions/current/logout':