fix: ignore basic auth header (#13473)

server/http_auth.go

@@ -3,6 +3,7 @@ package server
 import (
 	"encoding/json"
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/evcc-io/evcc/util/auth"
@@ -55,14 +56,19 @@ func updatePasswordHandler(auth auth.Auth) http.HandlerFunc {
 
 // read jwt from header and cookie
 func jwtFromRequest(r *http.Request) string {
-	tokenString := r.Header.Get("Authorization")
-	if tokenString == "" {
-		if cookie, _ := r.Cookie(authCookieName); cookie != nil {
-			tokenString = cookie.Value
-		}
+	// read from header
+	authHeader := r.Header.Get("Authorization")
+	splitToken := strings.Split(authHeader, "Bearer ")
+	if len(splitToken) == 2 {
+		return splitToken[1]
 	}
 
-	return tokenString
+	// read from cookie
+	if cookie, _ := r.Cookie(authCookieName); cookie != nil {
+		return cookie.Value
+	}
+
+	return ""
 }
 
 // authStatusHandler login status (true/false) based on jwt token. Error if admin password is not configured