[
https://issues.apache.org/jira/browse/KUDU-3777?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Marton Greber reassigned KUDU-3777:
-----------------------------------
Assignee: Jason Romero
> Webserver returns HTTP 500 instead of 401 for non-Negotiate Authorization
> headers on SPNEGO-protected endpoints
> ---------------------------------------------------------------------------------------------------------------
>
> Key: KUDU-3777
> URL: https://issues.apache.org/jira/browse/KUDU-3777
> Project: Kudu
> Issue Type: Bug
> Reporter: Marton Greber
> Assignee: Jason Romero
> Priority: Minor
>
> When a client sends an Authorization header with a scheme other than
> Negotiate (e.g. Bearer, or any other unrecognized scheme) to a
> SPNEGO-protected webserver endpoint, the server returns HTTP 500 (Internal
> Server Error) instead of HTTP 401 (Authentication Required).
> The root cause is in Webserver::BeginRequestCallback: RunSpnegoStep returns
> Status::InvalidArgument("bad Negotiate header") for non-Negotiate headers,
> but the error-dispatch only maps IsNotAuthorized() to 401 — all other error
> kinds fall through to 500. Since a malformed or wrong-scheme Authorization
> header is a client authentication error (not a server fault), the correct
> response is 401.
> The behavior is visible in SpnegoWebserverTest.TestInvalidHeaders which
> asserts HTTP 500 for this case.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
