Method CheckAuthentication

Modules/RESTAPI/src/mitkRestServer.cpp:755–819

}

bool RestServer::CheckAuthentication(const httplib::Request& req, httplib::Response& res)
{
  const auto& config = *m_RunningConfig;

  if (!config.requireAuth)
  {
    return true;
  }

  // Exempt health and info endpoints
  if (IsAuthExemptPath(req.path))
  {
    return true;
  }

  // Check Authorization header
  if (!req.has_header("Authorization"))
  {
    auto error = ErrorResponse::Unauthorized("Authentication required. Provide Authorization: Bearer <token> header.", req.path);
    res.status = 401;
    res.set_header("WWW-Authenticate", "Bearer");
    res.set_content(error.dump(), "application/json");

    this->RecordRequest(req.path, req.method, res.status, req.remote_addr);
    return false;
  }

  const std::string authHeader = req.get_header_value("Authorization");

  // Validate Bearer token format
  const std::string bearerPrefix = "Bearer ";
  if (authHeader.size() <= bearerPrefix.size() ||
      authHeader.substr(0, bearerPrefix.size()) != bearerPrefix)
  {
    auto error = ErrorResponse::Unauthorized("Invalid authorization format. Expected: Bearer <token>", req.path);
    res.status = 401;
    res.set_header("WWW-Authenticate", "Bearer");
    res.set_content(error.dump(), "application/json");

    this->RecordRequest(req.path, req.method, res.status, req.remote_addr);
    return false;
  }

  const std::string providedToken = authHeader.substr(bearerPrefix.size());

  // Constant-time comparison to prevent timing attacks
  if (!ConstantTimeCompare(providedToken, config.apiToken))
  {
    // Log every failed auth attempt for audit purposes.
    // NOTE: auth-specific brute-force throttling is not implemented separately.
    // Enable rate limiting (rateLimitEnabled=true) to bound the overall request
    // volume from any single IP when authentication is required.
    MITK_WARN << "REST API: authentication failed from " << SanitizeForLog(req.remote_addr);

    auto error = ErrorResponse::Unauthorized("Invalid API token", req.path);
    res.status = 401;
    res.set_header("WWW-Authenticate", "Bearer");
    res.set_content(error.dump(), "application/json");