Werk #20085: Bearer token authentication no longer starts a GUI session

Component

User interface

Title

Bearer token authentication no longer starts a GUI session

Date

Aug 14, 2026

Level

Trivial Change

Class

Bug Fix

Compatibility

Compatible - no manual interaction needed

Checkmk versions & editions

3.0.0b1 Not yet released	Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.5.0p13 Not yet released	Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT

Requests to GUI pages, for example login.py or index.py, that authenticated with an Authorization: Bearer <user> <password> header were treated like an interactive login: Checkmk stored a user session for them and answered with a session cookie.

Requests authenticated by a Bearer header no longer store a session and no longer receive a session cookie. Each request is authenticated from the header alone, as was already the case for the REST API.

This is not a security fix. The caller had to present valid credentials, and the session cookie granted no access beyond what those credentials already granted.

To the list of all Werks