When the access request header contains an expired Authorization and accesses a URL that does not exist, it should output a 404 error, but now it is outputting a 401 error.

Issue fork simple_oauth-3518947

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

qiutuo created an issue. See original summary.

bojan_dev made their first commit to this issue’s fork.

bojan_dev opened merge request !185

bojan_dev’s picture

bojan_dev commented
Status: Active » Needs review

I tested how Basic Auth does this, and a non existing URL will get 404 even if the credentials are incorrect, so I think it's a valid point. Please review the MR !185, it does not apply OAuth2 anymore if the URL is not valid.

  • bojan_dev committed 2ab4ea9c on 6.0.x 
    Issue #3518947: Don't apply oauth when URL is not valid
bojan_dev’s picture

bojan_dev commented
Version: 6.0.0 » 6.0.x-dev
Status: Needs review » Fixed

Now that this issue is closed, please review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, please credit people who helped resolve this issue.

  • bojan_dev committed 258c8785 on 6.0.x 
    Revert "Issue #3518947: Don't apply oauth when URL is not valid"
bojan_dev’s picture

bojan_dev commented
Status: Fixed » Closed (won't fix)

It appears there are cases where a route is not available, but OAuth2 still needs to be applied (see #3552854: REST routes broken again and #3547975: REST routes crashing, claiming unsupported format).
When comparing this with Basic Auth, the authenticate method returns NULL when the credentials are incorrect. However, in the simple_oauth case, it throws exceptions in different cases, which is relevant for interpretation by the requester. Marking this as won’t fix for now and reverted the MR.