Return 401 Unauthorized when using json/url encoded auth fails #5844
Conversation
When authentication using JSON payload or URL encoded payload fails, use the generic HTTP response code 401 Unauthorized instead of 400 Bad Request. This is a more appropriate response code for authentication errors and is consistent with the behavior of other authentication methods.
|
This is something in between a bugfix and a breaking change. Depending on how the client which is using JSON or URL encoded authentication is coded, this change might lead to mishandling the unauthenticated case. Not sure how widely and by what consumers this API is used. |
📝 WalkthroughWalkthroughThe changes update the authentication logic in the API by modifying how failed authentication attempts are handled for JSON and URL-encoded requests. The authentication method now explicitly raises an HTTP 401 Unauthorized error when credentials are invalid, instead of returning a falsy value. Corresponding test cases are updated to expect the new 401 status code and to verify the presence or absence of the Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant API (auth method)
participant _process_dict
Client->>API (auth method): Send authentication request (JSON or URL-encoded)
API (auth method)->>_process_dict: Validate credentials
_process_dict-->>API (auth method): Return result (truthy or falsy)
alt Credentials valid
API (auth method)-->>Client: Return success (True)
else Credentials invalid
API (auth method)-->>Client: Raise HTTP 401 Unauthorized
end
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (2)
⏰ Context from checks skipped due to timeout of 90000ms (4)
🔇 Additional comments (7)
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
There hasn't been any activity on this pull request recently. This pull request has been automatically marked as stale because of that and will be closed if no further activity occurs within 7 days. |
Proposed change
When authentication using JSON payload or URL encoded payload fails, use the generic HTTP response code 401 Unauthorized instead of 400 Bad Request.
This is a more appropriate response code for authentication errors and is consistent with the behavior of other authentication methods.
Type of change
Additional information
Checklist
ruff format supervisor tests)If API endpoints or add-on configuration are added/changed:
Summary by CodeRabbit
WWW_AUTHENTICATEheader is only present when appropriate.