Skip to content

Parse authorization header for session scheme without token

Cédric Krier requested to merge topic/default/trytond-session-token into branch/default

Since Werkzeug >= 2.3, it always tries to parse the Authorization header as a digest. If the session value which is encoded in base64 needs padding, the trailing = are interpreted as header values and the token attribute is not filled. In this case we must parse ourself the Authorization header to decode the base64 value as session.

Closes #12259 (closed)

Merge request reports