According to RFC2616, if a server responds with a 401 response it must also include a WWW-Authenticate header to allow for basic or digest authentication. As is, _services_run_access_callback() by default returns a 401, but it should return a 403.

CommentFileSizeAuthor
#1 2158563.1-fix-401.patch808 bytesdeviantintegral
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

deviantintegral’s picture

deviantintegral CreditAttribution: deviantintegral commented
Status: Active » Needs review
FileSize
2158563.1-fix-401.patch808 bytes

Status: Needs review » Needs work

The last submitted patch, 1: 2158563.1-fix-401.patch, failed testing.

ygerasimov’s picture

ygerasimov CreditAttribution: ygerasimov commented

I agree that we should respond with 403 code by default. 401 code should be responded by basic or digest authentication plugins with proper challenge.

@deviantintegral please also correct test with your patch as it expects 401.

kylebrowning’s picture

kylebrowning CreditAttribution: kylebrowning commented
Status: Needs work » Closed (fixed)

Fixed tests, commmited, thanks.