wohali commented on issue #823: Healthcheck endpoint authentication should be optional URL: https://github.com/apache/couchdb/issues/823#issuecomment-333409058 The problem here is that `require_value_user` is performed during _authentication_ phase, whereas checking for permissions for `_up` is done as an `authorization` phase check. Authentication happens before authorization. Right now, the authentication handlers are completely agnostic of the path of the request that comes in; introducing an exception to that flow duplicates the code in the authorization layer. If we're only ever going to allow access to `/_up` that's one thing, but if this ever needs to be extended for other endpoints, we'll be repeating ourselves, which could lead to inconsistent choices being made and increase the complexity of maintaining this code. I'll look at doing a PR, but there's no guarantees it'll land unchallenged in the code. ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected]
With regards, Apache Git Services
