.

blob.go

@@ -236,8 +236,16 @@ func handleGetBlobRaw(w http.ResponseWriter, r *gitRequest) {
 		}
 	}
 
+	// Extract only tokens from headers
+	h := url.Values{}
+	for k, v := range r.Request.Header {
+		if strings.HasSuffix(strings.ToUpper(k), "-TOKEN") {
+			h[k] = v
+		}
+	}
+
 	// Query download access auth for this project
-	authReply := verifyDownloadAccess(r.u, project, query.Encode())
+	authReply := verifyDownloadAccess(r.u, project, query.Encode(), h)
 	if authReply.RepoPath == "" {
 		// access denied - copy auth reply to client in full -
 		// there are HTTP code and other headers / body relevant for