Marton Greber created KUDU-3777:
-----------------------------------
Summary: Webserver returns HTTP 500 instead of 401 for
non-Negotiate Authorization headers on SPNEGO-protected endpoints
Key: KUDU-3777
URL: https://issues.apache.org/jira/browse/KUDU-3777
Project: Kudu
Issue Type: Bug
Reporter: Marton Greber
When a client sends an Authorization header with a scheme other than Negotiate
(e.g. Bearer, or any other unrecognized scheme) to a SPNEGO-protected webserver
endpoint, the server returns HTTP 500 (Internal Server Error) instead of HTTP
401 (Authentication Required).
The root cause is in Webserver::BeginRequestCallback: RunSpnegoStep returns
Status::InvalidArgument("bad Negotiate header") for non-Negotiate headers, but
the error-dispatch only maps IsNotAuthorized() to 401 — all other error kinds
fall through to 500. Since a malformed or wrong-scheme Authorization header is
a client authentication error (not a server fault), the correct response is 401.
The behavior is visible in SpnegoWebserverTest.TestInvalidHeaders which asserts
HTTP 500 for this case.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
