While it makes sense to redirect a normal HTML (i.e. from a web browser) request to the login page, it is not good to redirect a web service request. Currently, there is no distinction between the two, so when a web service request fails authentication, it receives a 200 with the HTML content of the login page instead of a 403. This makes it very difficult for an integration to determine whether and how the request failed.

CommentFileSizeAuthor
#3 web-service-status-code-2855531-3.patch3.09 KBkevin.dutra

Comments

kevin.dutra created an issue. See original summary.

kevin.dutra’s picture

kevin.dutra commented
Assigned: Unassigned » kevin.dutra
kevin.dutra’s picture

kevin.dutra commented
Assigned: kevin.dutra » Unassigned
Status: Active » Needs review
StatusFileSize
new web-service-status-code-2855531-3.patch3.09 KB

This will restrict it to only happen for HTML requests.

StefanPr’s picture

StefanPr commented
Status: Needs review » Reviewed & tested by the community

Exactly what I was looking for, nice!

I had another fixed using the current logic, but your fix is much better.
I was checking the acceptable content types of the request containing text/html.

R4032LoginSubscriber::onKernelException() 

$request = $event->getRequest();

// Skip redirect for non text/html 403 exceptions.
 if (!in_array(‘text/html’, $request->getAcceptableContentTypes())) {
   return;
 }

  • Nixou committed b264078 on 8.x-1.x authored by kevin.dutra 
    Issue #2855531 by kevin.dutra: Web service requests recieve incorrect...
nixou’s picture

nixou commented

Committed, thanks !

nixou’s picture

nixou commented
Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.