Skip to content

Send token via authorization header #524

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: metabrainz-notifications
Choose a base branch
from
Open

Send token via authorization header #524

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
65d72a6
Send token via authorization header
fettuccinae Aug 11, 2025
dd2a017
Fix tests and linting issues
fettuccinae Aug 12, 2025
1a2bd0a
Change docstrings
fettuccinae Aug 12, 2025
daf10a9
Fix url slash bug
fettuccinae Aug 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions metabrainz/decorators.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ def wrapped_function(*args, **kwargs):
def ccg_token_required(f):
"""
This decorator protects an endpoint by validating an access token.
Token should be provided as a query parameter.
Token should be provided in the Authorization header.
Token must be generated by an official MeB project and must contain 'notification' scope.

Raises:
Expand All @@ -90,10 +90,14 @@ def ccg_token_required(f):

"""
@wraps(f)
def decorated(*args,**kwargs):
token = request.args.get('token')
def decorated(*args, **kwargs):
auth_header = request.headers.get("Authorization")
if not auth_header or not auth_header.startswith("Bearer "):
raise APIBadRequest("Missing or invalid Authorization header")
token = auth_header.split(" ", 1)[1]
if not token:
raise APIBadRequest('Missing access token.')
raise APIBadRequest("Missing access token.")

data = {
"client_id": current_app.config["MUSICBRAINZ_CLIENT_ID"],
"client_secret": current_app.config["MUSICBRAINZ_CLIENT_SECRET"],
Expand Down
Loading