diff --git a/flexiapi/app/Http/Middleware/AuthenticateJWT.php b/flexiapi/app/Http/Middleware/AuthenticateJWT.php index 4d1399d..571608f 100644 --- a/flexiapi/app/Http/Middleware/AuthenticateJWT.php +++ b/flexiapi/app/Http/Middleware/AuthenticateJWT.php @@ -117,10 +117,15 @@ class AuthenticateJWT private function generateUnauthorizedBearerResponse(string $error, string $description): Response { + $bearer = 'Bearer ' . config('app.account_authentication_bearer'); + $bearer .= !empty(config('app.account_authentication_bearer')) + ? ', ' + : ''; + $response = new Response(); $response->header( 'WWW-Authenticate', - 'Bearer error="' . $error .'", error_description="'. $description . '"' + $bearer . 'error="' . $error . '", error_description="'. $description . '"' ); $response->setStatusCode(401); diff --git a/flexiapi/tests/Feature/AccountJWTAuthenticationTest.php b/flexiapi/tests/Feature/AccountJWTAuthenticationTest.php index 0d83341..2a5051a 100644 --- a/flexiapi/tests/Feature/AccountJWTAuthenticationTest.php +++ b/flexiapi/tests/Feature/AccountJWTAuthenticationTest.php @@ -57,6 +57,8 @@ class AccountJWTAuthenticationTest extends TestCase $password = Password::factory()->create(); + $bearer = 'authz_server="https://sso.test/", realm="sip.test.org"'; + config()->set('services.jwt.rsa_public_key_pem', $this->serverPublicKeyPem); $this->get($this->route)->assertStatus(400); @@ -136,7 +138,20 @@ class AccountJWTAuthenticationTest extends TestCase ->get($this->accountRoute) ->assertStatus(401); - $this->assertStringContainsString('invalid_token', $response->headers->get('WWW-Authenticate')); + $this->assertStringContainsString('invalid_token', $response->headers->get('WWW-Authenticate')); + + // ...with the bearer + config()->set('app.account_authentication_bearer', $bearer); + + $response = $this->withHeaders([ + 'Authorization' => 'Bearer ' . $token->toString(), + 'x-linphone-provisioning' => true, + ]) + ->get($this->accountRoute) + ->assertStatus(401); + + $this->assertStringContainsString($bearer . ', ', $response->headers->get('WWW-Authenticate')); + $this->assertStringContainsString('invalid_token', $response->headers->get('WWW-Authenticate')); // Wrong email $token = (new JwtFacade(null, $clock))->issue(