diff --git a/jams-server/src/main/java/net/jami/jams/server/servlets/filters/AdminApiFilter.java b/jams-server/src/main/java/net/jami/jams/server/servlets/filters/AdminApiFilter.java index 261c33ee3856864e86051593097c056b99b798d2..29b41ccab8d1360d1c93e79a9a8a3e07651cfa12 100644 --- a/jams-server/src/main/java/net/jami/jams/server/servlets/filters/AdminApiFilter.java +++ b/jams-server/src/main/java/net/jami/jams/server/servlets/filters/AdminApiFilter.java @@ -61,11 +61,11 @@ public class AdminApiFilter implements Filter { boolean authsuccess = false; boolean isLogin = false; if (request.getServletPath().contains("login")) isLogin = true; - if (request.getHeader("Bearer") != null){ + if(request.getHeader("authorization").contains("bearer") || request.getHeader("authorization").contains("Bearer")){ SignedJWT signedJWT = null; try { JWSVerifier jwsVerifier = new RSASSAVerifier(userAuthenticationModule.getAuthModulePubKey()); - signedJWT = SignedJWT.parse(request.getHeader("Bearer")); + signedJWT = SignedJWT.parse(request.getHeader("authorization").replace("bearer","").replace("Bearer","")); HashSet<AccessLevel> permissionLevels = new HashSet<>(); permissionLevels.add(AccessLevel.ADMIN); if(signedJWT.verify(jwsVerifier) && verifyValidity(signedJWT) && verifyLevel(signedJWT,permissionLevels)){ diff --git a/jams-server/src/main/java/net/jami/jams/server/servlets/filters/InstallFilter.java b/jams-server/src/main/java/net/jami/jams/server/servlets/filters/InstallFilter.java index 77ab4097ff51f20ff59ccdad54590569bf05f4f3..d49aa4c41e1e8e7a5c849e061cb9d30e5bd86e62 100644 --- a/jams-server/src/main/java/net/jami/jams/server/servlets/filters/InstallFilter.java +++ b/jams-server/src/main/java/net/jami/jams/server/servlets/filters/InstallFilter.java @@ -58,10 +58,10 @@ public class InstallFilter implements Filter { boolean isLogin = false; if(request.getServletPath().contains("start")) isLogin = true; SignedJWT signedJWT = null; - if(request.getHeader("Bearer") != null) { + if(request.getHeader("authorization").contains("bearer") || request.getHeader("authorization").contains("Bearer")){ try { JWSVerifier jwsVerifier = new RSASSAVerifier(userAuthenticationModule.getAuthModulePubKey()); - signedJWT = SignedJWT.parse(request.getHeader("Bearer")); + signedJWT = SignedJWT.parse(request.getHeader("authorization").replace("bearer","").replace("Bearer","")); if (signedJWT.verify(jwsVerifier) && signedJWT.getJWTClaimsSet().getExpirationTime().compareTo(new Date()) > 0) { authsuccess = true; request.setAttribute("username", signedJWT.getJWTClaimsSet().getSubject());