issue-1687: Limit the URI scope which support authentication via access_token cookie
@@ -64,7 +64,7 @@ class JWTAuthenticationSupplier
hasHeader = StringUtils.isNotBlank(authHeader) && authHeader.startsWith(BEARER_AUTHORIZATION_PREFIX);
}
// fallback - check if a cookie is present (necessary for EventSource; check gh#1046).
- else if (request.getCookies() != null)
+ else if (request.getCookies() != null && (request.getRequestURI().startsWith("/api") || request.getRequestURI().startsWith("/storages")))
{
hasCookie = Arrays.stream(request.getCookies())
.anyMatch(c -> c.getName()
