The extractAccessToken middleware sets req.authSession = null if a token is supplied via the Authorization: Bearer <token> header. Because of this, the checkWorkspaceOwner middleware finds login = undefined and immediately calls next(), completely bypassing workspace owner security validation for clients using Bearer tokens.
The
extractAccessTokenmiddleware setsreq.authSession = nullif a token is supplied via theAuthorization: Bearer <token>header. Because of this, thecheckWorkspaceOwnermiddleware findslogin = undefinedand immediately callsnext(), completely bypassing workspace owner security validation for clients using Bearer tokens.