View Issue Details

This issue affects 1 person(s).
 0
IDProjectCategoryView StatusLast Update
20623Bug reportsSurvey editingpublic2026-07-30 17:46
Reporterthf Assigned ToDenisChenu  
PrioritynoneSeverityblock 
Status assignedResolutionopen 
Summary20623: HTTP Authorization header field not treated as case-insensitive leading to new editor not working
Description

HTTP Authorization header field not treated as case-insensitive leading to new editor not working

In 'application/libraries/Api/Rest/Endpoint/EndpointFactory.php'[1], the check for the "Authorization" header field is not case-insensitive, as mandated by the HTTP standard.
Thus, the new editor won't work (i.e. be stuck with "Checking permissions…") when ran behind a http server or proxy that uses lower cases header fields (for example haproxy in HTTP/2 mode, as HTTP/2 requires the conversion of header fields to lower case).

[1] https://github.com/LimeSurvey/LimeSurvey/blob/9e6aa71beb752f11b68f03c33e554c81c71cdddc/application/libraries/Api/Rest/Endpoint/EndpointFactory.php#L232-L238

Steps To Reproduce

Modify "Authorization" request header to "authorization".

TagsNo tags attached.
Bug heat0
Complete LimeSurvey version number (& build)7.0.7+260729
I will donate to the project if issue is resolvedNo
Browser
Database type & versionMariaDB 10.11
Server OS (if known)
Webserver software & version (if known)
PHP Version8.3.2

Users monitoring this issue

There are no users monitoring this issue.

Activities

There are no notes attached to this issue.

Issue History

Date Modified Username Field Change
2026-07-30 16:30 thf New Issue
2026-07-30 17:46 tibor.pacalat Assigned To => DenisChenu
2026-07-30 17:46 tibor.pacalat Status new => assigned