extractSessionToken returns the session token carried by the given request headers. It mirrors the priority order used by apiKeyMiddleware: cookie, then Coder-Session-Token header, then Authorization: Bearer header.
(header http.Header)
| 864 | // apiKeyMiddleware: cookie, then Coder-Session-Token header, then |
| 865 | // Authorization: Bearer header. |
| 866 | func extractSessionToken(header http.Header) string { |
| 867 | if header == nil { |
| 868 | return "" |
| 869 | } |
| 870 | // Cookie (browser WebSocket upgrade - most common relay case). |
| 871 | if raw := header.Get(cookieHeader); raw != "" { |
| 872 | r := &http.Request{Header: http.Header{cookieHeader: {raw}}} |
| 873 | if c, err := r.Cookie(codersdk.SessionTokenCookie); err == nil && c.Value != "" { |
| 874 | return c.Value |
| 875 | } |
| 876 | } |
| 877 | // Coder-Session-Token header (SDK / CLI callers). |
| 878 | if v := header.Get(codersdk.SessionTokenHeader); v != "" { |
| 879 | return v |
| 880 | } |
| 881 | // Authorization: Bearer <token>. |
| 882 | if v := header.Get(authorizationHeader); len(v) > 7 && strings.EqualFold(v[:7], "bearer ") { |
| 883 | return strings.TrimSpace(v[7:]) |
| 884 | } |
| 885 | return "" |
| 886 | } |