From f2bd2203072a9ec0d94636b21c58e182d186732e Mon Sep 17 00:00:00 2001 From: Jared Wolff Date: Wed, 4 Mar 2026 21:55:06 -0500 Subject: [PATCH] fix(admin): support HttpOnly cookie auth in admin_guard admin_guard() only checked Authorization: Bearer header, ignoring the oxicloud_access HttpOnly cookie used by browser sessions. All admin endpoints (dashboard, OIDC settings, etc.) returned 401 for logged-in users. Fall back to cookie_auth::extract_cookie_value() when no Bearer token is present. --- src/interfaces/api/handlers/admin_handler.rs | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/interfaces/api/handlers/admin_handler.rs b/src/interfaces/api/handlers/admin_handler.rs index 1e4d1679..f230e793 100644 --- a/src/interfaces/api/handlers/admin_handler.rs +++ b/src/interfaces/api/handlers/admin_handler.rs @@ -50,12 +50,18 @@ async fn admin_guard(state: &AppState, headers: &HeaderMap) -> Result<(String, S let token = headers .get(header::AUTHORIZATION) .and_then(|v| v.to_str().ok()) - .and_then(|v| v.strip_prefix("Bearer ")) + .and_then(|v| v.strip_prefix("Bearer ").map(|s| s.to_string())) + .or_else(|| { + crate::interfaces::api::cookie_auth::extract_cookie_value( + headers, + crate::interfaces::api::cookie_auth::ACCESS_COOKIE, + ) + }) .ok_or_else(|| AppError::unauthorized("Authorization token required"))?; let claims = auth .token_service - .validate_token(token) + .validate_token(&token) .map_err(|e| AppError::unauthorized(format!("Invalid token: {}", e)))?; if claims.role != "admin" {