v0.333.0 (unreleased): the R-1155 check reads every token source FileBrowser reads, Basic auth included (security review)

controller/internal/web/files_sso_test.go

@@ -433,6 +433,20 @@ func TestFilesSSO_R1155_HouseholdTokenDiesWithTheSignOut(t *testing.T) {
 	if b := s.filesEntry(r); b.Code != http.StatusUnauthorized {
 		t.Fatalf("API call with the household's token as Bearer: %d, want 401", b.Code)
 	}
+	// Every other way FileBrowser 1.5.6 reads a token (backend/http/auth.go extractToken) — each must be refused too.
+	for name, hdr := range map[string]string{
+		"Basic auth, the token as the password": "Basic " + base64.StdEncoding.EncodeToString([]byte("x:"+household.Value)),
+		"Bearer with two spaces":                "Bearer  " + household.Value,
+		"lower-case bearer, trailing words":     "bearer " + household.Value + " x",
+	} {
+		r := httptest.NewRequest(http.MethodGet, "http://felhom-controller:8080"+filesAuthPath, nil)
+		r.Header.Set("X-Forwarded-Host", "files.example.hu")
+		r.Header.Set("X-Forwarded-Uri", "/api/users?id=self")
+		r.Header.Set("Authorization", hdr)
+		if b := s.filesEntry(r); b.Code != http.StatusUnauthorized {
+			t.Errorf("API call with the household's token as %s: %d, want 401", name, b.Code)
+		}
+	}
 	if q := filesAsk(s, "files.example.hu", "/api/raw?files=x&auth="+url.QueryEscape(household.Value), "*/*"); q.Code != http.StatusUnauthorized {
 		t.Fatalf("download with the household's token in ?auth=: %d, want 401", q.Code)
 	}