package digital.loom.rhizome.authentication;

import java.util.regex.Pattern;

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;

import com.auth0.jwt.internal.org.apache.commons.lang3.StringUtils;
import com.auth0.spring.security.api.Auth0AuthenticationFilter;
import com.google.common.base.MoreObjects;

public class CookieReadingAuth0AuthenticationFilter extends Auth0AuthenticationFilter {
    @Override
    protected String getToken( HttpServletRequest httpRequest ) {
        String authorizationCookie = null;

        for ( Cookie cookie : httpRequest.getCookies() ) {
            if ( StringUtils.equals( cookie.getName(), "authorization" ) ) {
                authorizationCookie = cookie.getValue();
                break;
            }
        }

        final String authorizationHeader = httpRequest.getHeader( "authorization" );
        if ( authorizationHeader == null ) {
            // "Unauthorized: No Authorization header was found"
            return null;
        }
        final String[] parts = MoreObjects.firstNonNull( authorizationHeader, authorizationCookie ).split( " " );
        if ( parts.length != 2 ) {
            // "Unauthorized: Format is Authorization: Bearer [token]"
            return null;
        }
        final String scheme = parts[ 0 ];
        final String credentials = parts[ 1 ];
        final Pattern pattern = Pattern.compile( "^Bearer$", Pattern.CASE_INSENSITIVE );
        return pattern.matcher( scheme ).matches() ? credentials : null;
    }
}

@@ -540,17 +540,106 @@
 = null;%0A
-%0A
+        Cookie%5B%5D cookies = httpRequest.getCookies();%0A        if ( cookies != null ) %7B%0A    
         
@@ -697,24 +697,28 @@
             
+ 
+   
 if ( StringU
@@ -786,16 +786,20 @@
         
+    
 authoriz
@@ -851,15 +851,37 @@
     
+    
 break;%0A
+                %7D%0A
     

Fix npe