Werk #20085: Bearer token authentication no longer starts a GUI session
| Component | User interface | ||
| Title | Bearer token authentication no longer starts a GUI session | ||
| Date | Aug 14, 2026 | ||
| Level | Trivial Change | ||
| Class | Bug Fix | ||
| Compatibility | Compatible - no manual interaction needed | ||
| Checkmk versions & editions |
|
Requests to GUI pages, for example login.py or index.py, that authenticated with an
Authorization: Bearer <user> <password> header were treated like an interactive login:
Checkmk stored a user session for them and answered with a session cookie.
Requests authenticated by a Bearer header no longer store a session and no longer receive a session cookie. Each request is authenticated from the header alone, as was already the case for the REST API.
This is not a security fix. The caller had to present valid credentials, and the session cookie granted no access beyond what those credentials already granted.