Hi everyone,
I’m currently working on integrating Keycloak authentication with a Frappe app, and I want to bypass the default Bearer token check for some specific scenarios. Because some services send Bearer token automatically and frappe block it.
I tried implementing a custom auth_hook like this:
def validate_keycloak_token():
authorization_header = frappe.get_request_header(“Authorization”, “”)
if authorization_header.lower().startswith("bearer "):
# Attempting to remove the Authorization header
del frappe.request.headers["Authorization"]
print("Middleware listening ...")
print("Authorization Header: ", frappe.get_request_header("Authorization", ""))
print("Request: ", frappe.request)
However, this throws a 500 Internal Server Error with the message:
‘EnvironHeaders’ objects are immutable
It seems like frappe.request.headers is based on Werkzeug’s EnvironHeaders, which is immutable by design. So directly modifying or deleting headers this way isn’t allowed.
My goal:
I want to bypass or manipulate the Authorization header (remove or replace it) before Frappe performs its internal Bearer token validation.