bitflicker64 commented on code in PR #557:
URL: https://github.com/apache/hugegraph-doc/pull/557#discussion_r4435100313
##########
content/en/docs/clients/restful-api/cypher.md:
##########
@@ -7,7 +7,8 @@ description: "Cypher REST API: Execute OpenCypher declarative
graph query langua
### 9.1 Cypher
-> The Cypher API always needs an `Authorization` header, either `Basic` or
`Bearer`. A request without one is rejected with `401`, even when the server
runs without authentication. The credentials are forwarded to the Gremlin
Server through `conf/remote-objects.yaml`.
+> When authentication is disabled, no `Authorization` header is required; when
enabled, `Basic` (standard RFC 4648 Base64) or `Bearer` tokens are supported.
Review Comment:
**Important: this note now says Cypher requests work without an
`Authorization` header when authentication is disabled, but the server rejects
them.**
On server master, `CypherAPI#client` accepts only `Basic` or `Bearer` and
otherwise throws `NotAuthorizedException("The Cypher-API called without any
authorization.")`. That check does not depend on the server's auth setting. So
a reader who follows this note and omits the header gets `401`. The base
version of this note described the behavior correctly. The new
`content/{en,cn}/docs/language/hugegraph-cypher.md` (around line 37) repeats
the same claim, and so does the CN copy of this note.
The `standard RFC 4648 Base64` wording itself is accurate: the decoder is
`Base64.getDecoder()`.
Suggested fix: restore the requirement, for example:
```suggestion
> The Cypher API always needs an `Authorization` header, either `Basic`
(standard RFC 4648 Base64) or `Bearer`. A request without one is rejected with
`401`, even when the server runs without authentication.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
