From 6d9c5b592b6a616edd9876ac3a8342cc87b7585e Mon Sep 17 00:00:00 2001
From: jpirnay <jens@pirnay.com>
Date: Sat, 11 Apr 2026 20:52:21 +0200
Subject: [PATCH] Review comment

---
 lib/KOReaderSync/KOReaderSyncClient.cpp | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/KOReaderSync/KOReaderSyncClient.cpp b/lib/KOReaderSync/KOReaderSyncClient.cpp
index 145eee73..2e60ce73 100644
--- a/lib/KOReaderSync/KOReaderSyncClient.cpp
+++ b/lib/KOReaderSync/KOReaderSyncClient.cpp
@@ -380,7 +380,16 @@ KOReaderSyncClient::Error KOReaderSyncClient::authenticate() {
     // The kosync auth response is always a JSON object. Guard against a reverse
     // proxy returning HTTP 200 + HTML (e.g. a login wall that followed all
     // redirects and landed on an auth page instead of the API endpoint).
-    if (!activeBuf->data || activeBuf->data[0] != '{') {
+    // Skip leading whitespace before checking for '{' so servers that emit
+    // a BOM or indent their JSON don't get incorrectly rejected.
+    if (!activeBuf->data) {
+      return SERVER_ERROR;
+    }
+    const char* p = activeBuf->data;
+    while (*p == ' ' || *p == '\t' || *p == '\r' || *p == '\n') {
+      p++;
+    }
+    if (*p != '{') {
       return SERVER_ERROR;
     }
     return OK;