# Collabora sends both access\_token and Authorization header to wopi backend for CheckFileInfo

**URL:** <https://forum.collaboraonline.com/t/collabora-sends-both-access-token-and-authorization-header-to-wopi-backend-for-checkfileinfo/2944>\
**Category:** Uncategorized\
**Created:** [September 4, 2024, 1:19pm UTC](https://forum.collaboraonline.com/t/collabora-sends-both-access-token-and-authorization-header-to-wopi-backend-for-checkfileinfo/2944 "2024-09-04T13:19:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ddscentral](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@ddscentral](https://forum.collaboraonline.com/u/ddscentral)\
**Post date:** [September 4, 2024, 1:19pm UTC](https://forum.collaboraonline.com/t/collabora-sends-both-access-token-and-authorization-header-to-wopi-backend-for-checkfileinfo/2944/1 "2024-09-04T13:19:39Z")

</div>

Hello,

During our integration of Collabora Online into our app, we have encountered a strange issue. After submitting the form with WOPISrc URL and access\_token (WOPISrc in URL, access\_token through form, just like in sample applications) to the editor URL retrieved from discovery XML, the editor fails to load, complaining it can’t read the file.  
From the logs, we found out that when trying to retrieve CheckFileInfo URL, Collabora sends both access\_token parameter and Authorzation: Bearer header with the same value as the access\_token to the backend server. This confuses the Spring application running in the backend since it treats both the header and the access\_token parameter as authentication tokens.

Is this behavior normal ? Is there any way to disable it ? We could adapt our backend application to ignore the Authorization header (or the access\_token) but I wanted to know whether it is possible to fix without altering the code.

Collabora version is 23.05.10.1 (git baa6eef)  
Spring application with custom WOPI backend.

---

<div class="post-metadata">

**Author:** ![meven](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.collaboraonline.com/meven/32/1316_2.png) [@meven](https://forum.collaboraonline.com/u/meven)\
**Post date:** [September 6, 2024, 8:11am UTC](https://forum.collaboraonline.com/t/collabora-sends-both-access-token-and-authorization-header-to-wopi-backend-for-checkfileinfo/2944/2 "2024-09-06T08:11:52Z")

</div>

Do you happen to use `access_header` parameter in your cool.html file (or elsewhere like in your form) ?  
The Permission header should not be present if you omit it.

[https://sdk.collaboraonline.com/docs/How\_to\_integrate.html?highlight=access\_header#authentication](https://sdk.collaboraonline.com/docs/How_to_integrate.html?highlight=access_header#authentication)

---

<div class="post-metadata">

**Author:** ![hub](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.collaboraonline.com/hub/32/883_2.png) [@hub](https://forum.collaboraonline.com/u/hub)\
**Post date:** [September 6, 2024, 2:15pm UTC](https://forum.collaboraonline.com/t/collabora-sends-both-access-token-and-authorization-header-to-wopi-backend-for-checkfileinfo/2944/3 "2024-09-06T14:15:06Z")

</div>

`access_token` is the only supported way, so you should ignore any `Authorization` header sent.

---

<div class="post-metadata">

**Author:** ![ddscentral](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@ddscentral](https://forum.collaboraonline.com/u/ddscentral)\
**Post date:** [September 9, 2024, 9:42am UTC](https://forum.collaboraonline.com/t/collabora-sends-both-access-token-and-authorization-header-to-wopi-backend-for-checkfileinfo/2944/4 "2024-09-09T09:42:21Z")

</div>

No, only access\_token is used.

---

<div class="post-metadata">

**Author:** ![ddscentral](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@ddscentral](https://forum.collaboraonline.com/u/ddscentral)\
**Post date:** [September 9, 2024, 9:43am UTC](https://forum.collaboraonline.com/t/collabora-sends-both-access-token-and-authorization-header-to-wopi-backend-for-checkfileinfo/2944/5 "2024-09-09T09:43:58Z")

</div>

Our backend dev did exactly that and configured the system to ignore the authorization header and this has fixed the issue.  
But still, it would be nice to avoid having to implement such workarounds as they make code harder to maintain.

---

<div class="post-metadata">

**Author:** ![darshan](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.collaboraonline.com/darshan/32/2230_2.png) [@darshan](https://forum.collaboraonline.com/u/darshan)\
**Post date:** [September 17, 2024, 7:07am UTC](https://forum.collaboraonline.com/t/collabora-sends-both-access-token-and-authorization-header-to-wopi-backend-for-checkfileinfo/2944/6 "2024-09-17T07:07:39Z")

</div>