[
https://issues.apache.org/jira/browse/KUDU-3777?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18093032#comment-18093032
]
Jason Romero commented on KUDU-3777:
------------------------------------
Hi there!
I'm looking to get involved in the Kudu project and I was hoping to help out
with this issue if it's still available.
I was taking a peek at {{webserver.cc}} and I'd love to try putting together a
patch for this as my first contribution.
Could someone possibly assign this to me? Thanks so much!
cc: [~mgreber]
> Webserver returns HTTP 500 instead of 401 for non-Negotiate Authorization
> headers on SPNEGO-protected endpoints
> ---------------------------------------------------------------------------------------------------------------
>
> Key: KUDU-3777
> URL: https://issues.apache.org/jira/browse/KUDU-3777
> Project: Kudu
> Issue Type: Bug
> Reporter: Marton Greber
> Priority: Minor
>
> When a client sends an Authorization header with a scheme other than
> Negotiate (e.g. Bearer, or any other unrecognized scheme) to a
> SPNEGO-protected webserver endpoint, the server returns HTTP 500 (Internal
> Server Error) instead of HTTP 401 (Authentication Required).
> The root cause is in Webserver::BeginRequestCallback: RunSpnegoStep returns
> Status::InvalidArgument("bad Negotiate header") for non-Negotiate headers,
> but the error-dispatch only maps IsNotAuthorized() to 401 — all other error
> kinds fall through to 500. Since a malformed or wrong-scheme Authorization
> header is a client authentication error (not a server fault), the correct
> response is 401.
> The behavior is visible in SpnegoWebserverTest.TestInvalidHeaders which
> asserts HTTP 500 for this case.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
