Release 2.18 (#4878)

src/API/Authentication/ApiRequestMatcher.php

@@ -26,6 +26,22 @@ final class ApiRequestMatcher implements RequestMatcherInterface
             return false;
         }
 
+        // ------------------------------------------------------------------------------------
+        // the next two checks are primarily here to make sure to return proper error messages
+
+        // let's use this firewall if a Bearer token is set in the header
+        // other cases like "bearer" are rejected earlier
+        if (($auth = $request->headers->get('Authorization')) !== null && str_starts_with($auth, 'Bearer ')) {
+            return true;
+        }
+
+        // let's use this firewall if the deprecated username & token combination is available
+        if ($request->headers->has(TokenAuthenticator::HEADER_USERNAME) &&
+            $request->headers->has(TokenAuthenticator::HEADER_TOKEN)) {
+            return true;
+        }
+        // ------------------------------------------------------------------------------------
+
         // checking for a previous session allows us to skip the API firewall and token access handler
         // we simply re-use the existing session when doing API calls from the frontend.
         // it is not necessary to check headers. if there is no valid session, we should always use this firewall