Conditionally set WWW-Authenticate header for AJAX requests

mpsijm · Jun 6, 2024 · 6df01fe · 6df01fe
1 parent e1f78ca
commit 6df01fe
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/webapp/src/Security/DOMJudgeBasicAuthenticator.php b/webapp/src/Security/DOMJudgeBasicAuthenticator.php
@@ -67,7 +67,11 @@ public function onAuthenticationFailure(Request $request, AuthenticationExceptio
         // Otherwise, we pass along to the next authenticator.
         if ($exception instanceof BadCredentialsException || $exception instanceof UserNotFoundException) {
             $resp = new Response('', Response::HTTP_UNAUTHORIZED);
-            $resp->headers->set('WWW-Authenticate', sprintf('Basic realm="%s"', 'Secured Area'));
+
+            if (!$request->isXmlHttpRequest()) {
+                $resp->headers->set('WWW-Authenticate', sprintf('Basic realm="%s"', 'Secured Area'));
+            }
+
             return $resp;
         }