Public REST API - ignore Authorization header

Question

I have created public REST resource using APEX

https://stream-capricorn-3239-dev-ed.scratch.my.salesforce-sites.com/services/apexrest/helloWorld

@RestResource(urlMapping='/helloWorld/*')
global class RestWebservice {

  @HttpGet
  global static String helloWorld(){
    return 'HelloWorld';
  }

}

it works perfectly when we make calls without Bearer Token Header.

curl --location --request GET 'https://stream-capricorn-3239-dev-ed.scratch.my.salesforce-sites.com/services/apexrest/helloWorld' \
--header 'Content-Type: application/json' \

Whereas my external system appends a reference bearer token header on each call it makes to salesforce is failing.

curl --location --request GET 'https://stream-capricorn-3239-dev-ed.scratch.my.salesforce-sites.com/services/apexrest/helloWorld' \
--header 'Authorization: Bearer dummy_value' \

Any help resolving this issue, Unable to change external system behaviour or add new header to the request.

The only option I have is handling through Salesforce, any chance we can bypass in Salesforce?

Answer 1

This is a feature; you can theoretically log in to any Site, Community, etc. If you provide an authorization header, it will be interpreted as a Salesforce session. If Salesforce doesn't recognize the session token, it will reject the transaction.

This happens as one of the very first steps in any transaction with Salesforce, because it's what's used to set the user context for the rest of the transaction. This is important for security, as before the user is identified, Salesforce doesn't know if the user has permission to do anything yet. Any workaround is going to involve outside resources. For example, you can set up a small Heroku server to act a proxy to remove the header.