Merge pull request #3942 from skoeva/auth3-fix

backend: auth: Improve ParseClusterAndToken function

Author: illume

backend/pkg/auth/auth.go

@@ -61,7 +61,8 @@ var clusterPathRegex = regexp.MustCompile(`^/clusters/([^/]+)/.*`)
 var bearerTokenRegex = regexp.MustCompile(`^[\x21-\x7E]+$`)
 
 // ParseClusterAndToken extracts the cluster name from the URL path and
-// the Bearer token from the Authorization header of the HTTP request.
+// the Bearer token from the Authorization header of the HTTP request, falling
+// back to the cluster cookie when the header is missing.
 func ParseClusterAndToken(r *http.Request) (string, string) {
 	cluster := ""
 
@@ -70,6 +71,7 @@ func ParseClusterAndToken(r *http.Request) (string, string) {
 		cluster = matches[1]
 	}
 
+	// Try Authorization header first (for backward compatibility)
 	token := strings.TrimSpace(r.Header.Get("Authorization"))
 	if strings.Contains(token, ",") {
 		return cluster, ""
@@ -80,6 +82,13 @@ func ParseClusterAndToken(r *http.Request) (string, string) {
 		token = strings.TrimSpace(token[len(bearerPrefix):])
 	}
 
+	// If no auth header, try cookie
+	if token == "" && cluster != "" {
+		if cookieToken, err := GetTokenFromCookie(r, cluster); err == nil && cookieToken != "" {
+			token = cookieToken
+		}
+	}
+
 	if token != "" && !bearerTokenRegex.MatchString(token) {
 		return cluster, ""
 	}

backend/pkg/auth/auth_test.go

@@ -104,6 +104,7 @@ var parseClusterAndTokenTests = []struct {
 	authHeader  string
 	wantCluster string
 	wantToken   string
+	cookies     []*http.Cookie
 }{
 	{
 		name:        "standard case",
@@ -154,6 +155,18 @@ var parseClusterAndTokenTests = []struct {
 		wantCluster: "",
 		wantToken:   "some-token",
 	},
+	{
+		name:        "cookie fallback when header missing",
+		url:         "/clusters/cookie-cluster/api",
+		wantCluster: "cookie-cluster",
+		wantToken:   "cookie-token",
+		cookies: []*http.Cookie{
+			{
+				Name:  "headlamp-auth-cookie-cluster.0",
+				Value: "cookie-token",
+			},
+		},
+	},
 }
 
 func TestParseClusterAndToken(t *testing.T) {
@@ -168,6 +181,10 @@ func TestParseClusterAndToken(t *testing.T) {
 				req.Header.Set("Authorization", tt.authHeader)
 			}
 
+			for _, cookie := range tt.cookies {
+				req.AddCookie(cookie)
+			}
+
 			cluster, token := auth.ParseClusterAndToken(req)
 			if cluster != tt.wantCluster {
 				t.Errorf("ParseClusterAndToken() got cluster %q, want %q", cluster, tt.wantCluster)