From 60d1ca175befedbf56f97f12a1376cd509d9f275 Mon Sep 17 00:00:00 2001
From: Julien Veyssier <julien-nc@posteo.net>
Date: Wed, 25 Mar 2026 13:00:36 +0100
Subject: [PATCH] in the user backend: only try to validate the auth if the
 Authorization header's value starts with 'Bearer'

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
(cherry picked from commit 2aa104a380f597e4f9088b9d46758480b9bd4a5c)
Signed-off-by: Misha M.-Kupriyanov <kupriyanov@strato.de>
---
 lib/User/Backend.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/User/Backend.php b/lib/User/Backend.php
index 2a99bb38b..2aa027773 100644
--- a/lib/User/Backend.php
+++ b/lib/User/Backend.php
@@ -233,6 +233,10 @@ public function getCurrentUserId(): string {
 
 		// get the bearer token from headers
 		$headerToken = $this->request->getHeader(Application::OIDC_API_REQ_HEADER);
+		if (!str_starts_with($headerToken, 'bearer ') && !str_starts_with($headerToken, 'Bearer ')) {
+			$this->logger->debug('No Bearer token');
+			return '';
+		}
 		$headerToken = preg_replace('/^bearer\s+/i', '', $headerToken);
 		if ($headerToken === '') {
 			$this->logger->debug('No Bearer token');