add checking cron secret as part of header

1 files changed, 2 insertions, 1 deletions

diff --git a/api/app.py b/api/app.py
index be747e7..37fe900 100644
--- a/api/app.py
+++ b/api/app.py
@@ -212,7 +212,8 @@ def verify_answers():
 def clear_sessions():
     auth = request.headers.get("Authorization")
     stored_auth = os.environ.get("AUTHORIZATION")
-    if auth != stored_auth:
+    cron_secret = os.environ.get("CRON_SECRET")
+    if auth != stored_auth or auth != cron_secret:
         return jsonify({"error": "Unauthorized"}), 401
     server = create_database_connection()
     if server.check_health() is False: