From 62a81899177498adf4c71a53a204997225e1b16a Mon Sep 17 00:00:00 2001
From: Peter Bieringer <pb@bieringer.de>
Date: Sun, 22 Mar 2026 21:28:55 +0100
Subject: [PATCH] contrib/apache,caddy: extend URI for no-auth

---
 contrib/apache/radicale.conf     | 18 +++++++++---------
 contrib/caddy/radicale.caddyfile |  8 ++++----
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/contrib/apache/radicale.conf b/contrib/apache/radicale.conf
index 385ee159..205cc975 100644
--- a/contrib/apache/radicale.conf
+++ b/contrib/apache/radicale.conf
@@ -50,8 +50,8 @@
 	RewriteCond %{REQUEST_METHOD} GET
 	RewriteRule ^/radicale/$ /radicale/.web/ [R,L]
 
-	<LocationMatch "^/radicale/\.web.*>
-		# Internal WebUI does not need authentication at all
+	<LocationMatch "^/radicale/\.(web|token).*>
+		# Internal WebUI or Token does not need authentication at all
 		RequestHeader    set X-Script-Name /radicale
 
 		RequestHeader    set X-Forwarded-Port "%{SERVER_PORT}s"
@@ -69,7 +69,7 @@
 		</IfDefine>
 	</LocationMatch>
 
-	<LocationMatch "^/radicale(?!/\.web)">
+	<LocationMatch "^/radicale(?!/\.(web|token))">
 		RequestHeader    set X-Script-Name /radicale
 
 		RequestHeader    set X-Forwarded-Port "%{SERVER_PORT}s"
@@ -133,8 +133,8 @@
 
 	WSGIScriptAlias /radicale /usr/share/radicale/radicale.wsgi
 
-	# Internal WebUI does not need authentication at all
-	<LocationMatch "^/radicale/\.web.*>
+	# Internal WebUI or Token does not need authentication at all
+	<LocationMatch "^/radicale/\.(web|token).*>
 		RequestHeader    set X-Script-Name /radicale
 
 		Require local
@@ -143,7 +143,7 @@
 		</IfDefine>
 	</LocationMatch>
 
-	<LocationMatch "^/radicale(?!/\.web)">
+	<LocationMatch "^/radicale(?!/\.(web|token))">
 		RequestHeader    set X-Script-Name /radicale
 
 		<IfDefine !RADICALE_SERVER_USER_AUTHENTICATION>
@@ -221,7 +221,7 @@ CustomLog logs/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
 	RewriteCond %{REQUEST_METHOD} GET
 	RewriteRule ^/$ /.web/ [R,L]
 
-	<LocationMatch "^/\.web.*>
+	<LocationMatch "^/\.(web|token).*>
 		RequestHeader    set X-Forwarded-Port "%{SERVER_PORT}s"
 		RequestHeader    set X-Forwarded-Proto expr=%{REQUEST_SCHEME}
 
@@ -237,7 +237,7 @@ CustomLog logs/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
 		</IfDefine>
 	</LocationMatch>
 
-	<LocationMatch "^(?!/\.web)">
+	<LocationMatch "^(?!/\.(web|token))">
 		RequestHeader    set X-Forwarded-Port "%{SERVER_PORT}s"
 		RequestHeader    set X-Forwarded-Proto expr=%{REQUEST_SCHEME}
 
@@ -292,7 +292,7 @@ CustomLog logs/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
 
 	WSGIScriptAlias / /usr/share/radicale/radicale.wsgi
 
-	<LocationMatch "^/(?!/\.web)">
+	<LocationMatch "^/(?!/\.(web|token))">
 		<IfDefine !RADICALE_SERVER_USER_AUTHENTICATION>
 			## User authentication handled by "radicale"
 			Require local
diff --git a/contrib/caddy/radicale.caddyfile b/contrib/caddy/radicale.caddyfile
index b578b383..deaf558b 100644
--- a/contrib/caddy/radicale.caddyfile
+++ b/contrib/caddy/radicale.caddyfile
@@ -11,13 +11,13 @@ caldav.example.com {
 
     redir @get-root /.web/
 
-    # Do not auth on /.web/* 
-    @not-webui {
-        not path /.web/*
+    # Do not auth on /.web/* or /.token/*
+    @not-auth {
+        not path /.web/* /.token/*
     }
 
     # disable this in case authentication is handled by Radicale
-    basic_auth @not-webui {
+    basic_auth @not-auth {
         USER HASH
     }