[Bug] Bearer Token Not Sent for First Frame API Request in DCM4CHEE-Secure

[shivam-pandey-qss]

Describe the Bug

I am passing a Bearer token in two places within the OHIF codebase to authenticate API requests, but the token is not being sent when retrieving the first frame. As a result, the UI breaks. However, for all other API requests, the Bearer token is being sent successfully.

Steps to Reproduce

1.In extensions/default/src/DicomWebDataSource/index.js

getAuthorizationHeader = () => {
const xhrRequestHeaders = {};
const authHeaders = userAuthenticationService.getAuthorizationHeader();
if (authHeaders && authHeaders.Authorization) {
xhrRequestHeaders.Authorization = authHeaders.Authorization;
}
xhrRequestHeaders.Authorization = Bearer ${dcm_token};
return xhrRequestHeaders;
};

2.In initWADOImageLoader

beforeSend: function (xhr) {
const dcm_token = sessionStorage.getItem('dcm4chee_token');
const sourceConfig = extensionManager.getActiveDataSource()?.[0].getConfig() ?? {};
const headers = userAuthenticationService.getAuthorizationHeader();
const acceptHeader = utils.generateAcceptHeader(
sourceConfig.acceptHeader,
sourceConfig.requestTransferSyntaxUID,
sourceConfig.omitQuotationForMultipartRequest
);

const xhrRequestHeaders = {
Accept: acceptHeader,
};
if (dcm_token) {
xhrRequestHeaders.Authorization = Bearer ${dcm_token};
}
if (headers) {
Object.assign(xhrRequestHeaders, headers);
}

return xhrRequestHeaders;
}

The current behavior

For the API request to retrieve the first frame, the Bearer token is not being sent, causing the UI to break. For all other subsequent API requests, the Bearer token is correctly included, and the APIs function as expected.
I suspect the issue is related to how the beforeSend logic is handled for the first frame, but I'm unsure how to resolve it. Any guidance or suggestions would be appreciated.

The expected behavior

All api's to DCM4CHEE should include the bearer token.

OS

Linux

Node version

20.17.0

Browser

Firefox

[GlebVST]

Also seeing this issue with a DicomWebDataSource that requires auth header.
Looks like dicomImageLoader.beforeSend is getting ignored on the first call to retrieve transferSyntax tag during setViewportData -> setStack -> getTagFromInstance flow.
Not sure why - but there is another attempt later which successfully calls beforeSend and executes fine, but still the UI gets into error state due to a failed original request.

[GlebVST]

Actually upgrading to the latest dicom loader helped

"@cornerstonejs/dicom-image-loader": "^1.84.4",

[shivam-pandey-qss]

Actually upgrading to the latest dicom loader helped

"@cornerstonejs/dicom-image-loader": "^1.84.4",

thanks it helped.