[
https://issues.apache.org/jira/browse/KUDU-3777?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18095315#comment-18095315
]
ASF subversion and git services commented on KUDU-3777:
-------------------------------------------------------
Commit 84f05a47990945843430a451318530a7cca6e61b in kudu's branch
refs/heads/master from senzei1
[ https://gitbox.apache.org/repos/asf?p=kudu.git;h=84f05a479 ]
KUDU-3777: return HTTP 401 for bad SPNEGO headers
When a client sends an Authorization header with an unrecognized scheme
(e.g., Bearer) to a SPNEGO-protected webserver endpoint, RunSpnegoStep
returns Status::InvalidArgument. Previously, the error dispatch in
Webserver::BeginRequestCallback only mapped IsNotAuthorized() to HTTP
401, allowing InvalidArgument to fall through to an HTTP 500.
This patch updates the error dispatch to map IsInvalidArgument() to
HTTP 401 (Authentication Required), ensuring the correct client error
is returned. The SpnegoWebserverTest.TestInvalidHeaders test has also
been updated to expect the correct 401 response.
Change-Id: Ie1e85a991c50cddeec76a2ab16a65b34fe3fee5c
Reviewed-on: http://gerrit.cloudera.org:8080/24545
Tested-by: Kudu Jenkins
Reviewed-by: Gabriella Lotz <[email protected]>
Reviewed-by: Marton Greber <[email protected]>
Reviewed-by: Attila Bukor <[email protected]>
> Webserver returns HTTP 500 instead of 401 for non-Negotiate Authorization
> headers on SPNEGO-protected endpoints
> ---------------------------------------------------------------------------------------------------------------
>
> Key: KUDU-3777
> URL: https://issues.apache.org/jira/browse/KUDU-3777
> Project: Kudu
> Issue Type: Bug
> Reporter: Marton Greber
> Assignee: Jason Romero
> Priority: Minor
>
> When a client sends an Authorization header with a scheme other than
> Negotiate (e.g. Bearer, or any other unrecognized scheme) to a
> SPNEGO-protected webserver endpoint, the server returns HTTP 500 (Internal
> Server Error) instead of HTTP 401 (Authentication Required).
> The root cause is in Webserver::BeginRequestCallback: RunSpnegoStep returns
> Status::InvalidArgument("bad Negotiate header") for non-Negotiate headers,
> but the error-dispatch only maps IsNotAuthorized() to 401 — all other error
> kinds fall through to 500. Since a malformed or wrong-scheme Authorization
> header is a client authentication error (not a server fault), the correct
> response is 401.
> The behavior is visible in SpnegoWebserverTest.TestInvalidHeaders which
> asserts HTTP 500 for this case.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
