@ixiam/n8n-nodes-civicrm 3.2.3 → 3.2.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -81,11 +81,18 @@ async function civicrmApiRequest(method, path, body, runtimeBearerToken) {
|
|
|
81
81
|
// path below has (empty JWT response -> retry with the plaintext API key),
|
|
82
82
|
// and it is exactly what must NOT happen here, so this path never falls
|
|
83
83
|
// through into that logic.
|
|
84
|
+
//
|
|
85
|
+
// The token is sent with the same header(s) as the credential's JWT path
|
|
86
|
+
// (`jwtHeaderMode`, default `xheader` = X-Civi-Auth). A hardcoded
|
|
87
|
+
// `Authorization` header is not enough: many nginx + PHP-FPM setups do not
|
|
88
|
+
// pass it to PHP, so CiviCRM sees an unauthenticated request and rejects it
|
|
89
|
+
// ("SECURITY ALERT: Ajax requests can only be issued by javascript
|
|
90
|
+
// clients"). X-Civi-Auth always reaches CiviCRM.
|
|
84
91
|
if (runtimeBearerToken) {
|
|
85
92
|
const headers = {
|
|
86
93
|
'Content-Type': 'application/x-www-form-urlencoded',
|
|
87
|
-
Authorization: `Bearer ${runtimeBearerToken}`,
|
|
88
94
|
};
|
|
95
|
+
applyJwtHeaders(headers, runtimeBearerToken, getJwtHeaderMode(credentials));
|
|
89
96
|
const options = {
|
|
90
97
|
method,
|
|
91
98
|
url: `${baseUrl}${path}`,
|