🔒 Made session-tokens more secure

2023-01-22 00:17:09 +01:00
parent f532e503d6
commit 95b0a4fa63
3 changed files with 55 additions and 11 deletions
@@ -43,12 +43,12 @@ class OAuth2PasswordBearerWithCookie(OAuth2):
        super().__init__(flows=flows, scheme_name=scheme_name, auto_error=auto_error)

    async def __call__(self, request: Request) -> Optional[str]:
-        authorization: str = request.cookies.get("access_token")  # changed to accept access token from httpOnly Cookie
-        if authorization is None:
-            try:
-                authorization = request.state.access_token
-            except AttributeError:
-                pass
+        try:
+            authorization = request.state.access_token
+        except AttributeError:
+            authorization: str = request.cookies.get(
+                "access_token"
+            )  # changed to accept access token from httpOnly Cookie
        scheme, param = get_authorization_scheme_param(authorization)
        if not authorization or scheme.lower() != "bearer":
            if self.auto_error: