Changed auth check order

Fixes an issue where authentication is not required but is present
anyway, leading to WebAuthFailException when trying to get
web user for authentication headers coming from a reverse-proxy.

Affects issues:
- #1215
This commit is contained in:
Rsl1122 2019-11-08 12:13:15 +02:00
parent cafcb61cf5
commit f17470ee6c

View File

@ -139,8 +139,7 @@ public class ResponseHandler extends TreePageHandler {
if (pageHandler == null) {
return responseFactory.pageNotFound404();
} else {
boolean isAuthorized = authentication.isPresent() && pageHandler.isAuthorized(authentication.get(), target);
if (!isAuthRequired || isAuthorized) {
if (!isAuthRequired || pageHandler.isAuthorized(authentication.get(), target)) {
return pageHandler.getResponse(request, target);
}
return responseFactory.forbidden403();