View Issue Details

This issue affects 1 person(s).
 12
IDProjectCategoryView StatusLast Update
20623Bug reportsSurvey editingpublic2026-08-13 17:21
Reporterthf Assigned Toc_schmitz  
PrioritynoneSeverityblock 
Status closedResolutionfixed 
Summary20623: HTTP Authorization header field not treated as case-insensitive leading to new editor not working
Description

HTTP Authorization header field not treated as case-insensitive leading to new editor not working

In 'application/libraries/Api/Rest/Endpoint/EndpointFactory.php'[1], the check for the "Authorization" header field is not case-insensitive, as mandated by the HTTP standard.
Thus, the new editor won't work (i.e. be stuck with "Checking permissions…") when ran behind a http server or proxy that uses lower cases header fields (for example haproxy in HTTP/2 mode, as HTTP/2 requires the conversion of header fields to lower case).

[1] https://github.com/LimeSurvey/LimeSurvey/blob/9e6aa71beb752f11b68f03c33e554c81c71cdddc/application/libraries/Api/Rest/Endpoint/EndpointFactory.php#L232-L238

Steps To Reproduce

Modify "Authorization" request header to "authorization".

TagsNo tags attached.
Bug heat12
Complete LimeSurvey version number (& build)7.0.7+260729
I will donate to the project if issue is resolvedNo
Story point estimate
Browser
Database type & versionMariaDB 10.11
Server OS (if known)
Webserver software & version (if known)
PHP Version8.3.2

Relationships

has duplicate 20646 closedtibor.pacalat REST API returns 401 under HTTP/2: case-sensitive Authorization header lookup breaks the new question editor 

Users monitoring this issue

There are no users monitoring this issue.

Activities

DenisChenu

DenisChenu

2026-07-31 11:14

developer   ~85287

Never work on Api/Rest/ (and doesn't really want to start)

@gabrieljenik ?

c_schmitz

c_schmitz

2026-07-31 12:20

administrator   ~85291

Will take it - easy fix.

c_schmitz

c_schmitz

2026-08-12 13:03

administrator   ~85451

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=40145

LimeBot

LimeBot

2026-08-13 17:21

administrator   ~85470

Fixed in Release 7.0.10+260813

Related Changesets

LimeSurvey: master f720a9bb

2026-08-12 13:03

c_schmitz

Committer: GitHub


Details Diff
Fixed issue 20623: HTTP Authorization header field not treated as case-insensitive leading to new editor not working (#5186) Affected Issues
20623
mod - application/libraries/Api/Rest/Endpoint/EndpointFactory.php Diff File

Issue History

Date Modified Username Field Change
2026-07-30 16:30 thf New Issue
2026-07-30 17:46 tibor.pacalat Assigned To => DenisChenu
2026-07-30 17:46 tibor.pacalat Status new => assigned
2026-07-31 11:14 DenisChenu Assigned To DenisChenu => tibor.pacalat
2026-07-31 11:14 DenisChenu Status assigned => new
2026-07-31 11:14 DenisChenu Note Added: 85287
2026-07-31 11:14 DenisChenu Bug heat 0 => 2
2026-07-31 11:19 tibor.pacalat Assigned To tibor.pacalat => gabrieljenik
2026-07-31 12:19 c_schmitz Assigned To gabrieljenik => c_schmitz
2026-07-31 12:20 c_schmitz Note Added: 85291
2026-07-31 12:20 c_schmitz Bug heat 2 => 4
2026-07-31 12:21 c_schmitz Status new => assigned
2026-08-12 10:26 tibor.pacalat Relationship added has duplicate 20646
2026-08-12 10:26 tibor.pacalat Bug heat 4 => 10
2026-08-12 13:03 c_schmitz Changeset attached => LimeSurvey master f720a9bb
2026-08-12 13:03 c_schmitz Note Added: 85451
2026-08-12 13:03 c_schmitz Status assigned => resolved
2026-08-12 13:03 c_schmitz Resolution open => fixed
2026-08-13 17:21 LimeBot Note Added: 85470
2026-08-13 17:21 LimeBot Status resolved => closed
2026-08-13 17:21 LimeBot Bug heat 10 => 12