ceciliayg/UAS_WebGIS_CeciliaYvonGunawan_D1041231056
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix tab session isolation by using stateless JWT and custom X-Authorization header

Browse Source
This commit is contained in:
cygouw
2026-06-12 16:21:16 +07:00
parent f379de42e0
commit 559aa928bc
2 changed files with 22 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
povertymap/api/config.php
+7 -3
View File
@@ -90,14 +90,18 @@ function jwt_decode(string $jwt, string $secret): ?array {
function getAuthorizationHeader(): string {
$headers = null;
if (isset($_SERVER['Authorization'])) {
if (isset($_SERVER['HTTP_X_AUTHORIZATION'])) {
$headers = trim($_SERVER["HTTP_X_AUTHORIZATION"]);
} else if (isset($_SERVER['Authorization'])) {
$headers = trim($_SERVER["Authorization"]);
} else if (isset($_SERVER['HTTP_AUTHORIZATION'])) {
$headers = trim($_SERVER["HTTP_AUTHORIZATION"]);
} else if (function_exists('apache_request_headers')) {
$requestHeaders = apache_request_headers();
$requestHeaders = array_change_key_case($requestHeaders, CASE_LOWER);
if (isset($requestHeaders['authorization'])) {
if (isset($requestHeaders['x-authorization'])) {
$headers = trim($requestHeaders['x-authorization']);
} else if (isset($requestHeaders['authorization'])) {
$headers = trim($requestHeaders['authorization']);
}
}
@@ -117,7 +121,7 @@ function getCurrentUser(): ?array {
return $payload;
}
}
return $_SESSION['user'] ?? null;
return null;
}
/**
povertymap/index.html
+13 -1
View File
@@ -264,12 +264,24 @@
const originalFetch = window.fetch;
window.fetch = function(url, options) {
options = options || {};
options.headers = options.headers || {};
const token = sessionStorage.getItem('user_token');
if (token) {
if (options.headers instanceof Headers) {
if (!options.headers.has('Authorization')) {
options.headers.set('Authorization', 'Bearer ' + token);
}
if (!options.headers.has('X-Authorization')) {
options.headers.set('X-Authorization', 'Bearer ' + token);
}
} else {
options.headers = options.headers || {};
if (!options.headers['Authorization'] && !options.headers['authorization']) {
options.headers['Authorization'] = 'Bearer ' + token;
}
if (!options.headers['X-Authorization'] && !options.headers['x-authorization']) {
options.headers['X-Authorization'] = 'Bearer ' + token;
}
}
}
return originalFetch(url, options);
};