add check for server session RPC requests (#16638)

skyeturriff · web-flow · commit 464ca6f65e46 · 2025-11-06T19:46:14.000-05:00
diff --git a/src/cpp/server/session/ServerSessionRpc.cpp b/src/cpp/server/session/ServerSessionRpc.cpp
@@ -117,12 +117,8 @@ void validationHandler(
 {
    std::string username;
 
-   // validate that the secret matches what we expect
-   std::string secret =
-         pConnection->request().headerValue(kServerRpcSecretHeader);
-
    // if there is no secret, check for a message signature instead
-   if (secret.empty())
+   if (!pConnection->request().containsHeader(kServerRpcSecretHeader))
    {
       if (!validateSecureCookie(pConnection, &username, fallbackAllowed))
       {
@@ -134,6 +130,8 @@ void validationHandler(
    else
    {
       // used for traditional unix socket mode
+      // validate that the secret matches what we expect
+      std::string secret = pConnection->request().headerValue(kServerRpcSecretHeader);
       if (secret != s_sessionSharedSecret)
       {
          if (!fallbackAllowed)

Original file line number	Diff line number	Diff line change
`@@ -117,12 +117,8 @@ void validationHandler(`
`117`	`117`	`{`
`118`	`118`	`std::string username;`
`119`	`119`
`120`		`- // validate that the secret matches what we expect`
`121`		`- std::string secret =`
`122`		`- pConnection->request().headerValue(kServerRpcSecretHeader);`
`123`		`-`
`124`	`120`	`// if there is no secret, check for a message signature instead`
`125`		`- if (secret.empty())`
	`121`	`+ if (!pConnection->request().containsHeader(kServerRpcSecretHeader))`
`126`	`122`	`{`
`127`	`123`	`if (!validateSecureCookie(pConnection, &username, fallbackAllowed))`
`128`	`124`	`{`
`@@ -134,6 +130,8 @@ void validationHandler(`
`134`	`130`	`else`
`135`	`131`	`{`
`136`	`132`	`// used for traditional unix socket mode`
	`133`	`+ // validate that the secret matches what we expect`
	`134`	`+ std::string secret = pConnection->request().headerValue(kServerRpcSecretHeader);`
`137`	`135`	`if (secret != s_sessionSharedSecret)`
`138`	`136`	`{`
`139`	`137`	`if (!fallbackAllowed)`