Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Incorrect API error response when forbidden #10340

Open
qqmyers opened this issue Feb 23, 2024 · 1 comment · May be fixed by #11116
Open

Incorrect API error response when forbidden #10340

qqmyers opened this issue Feb 23, 2024 · 1 comment · May be fixed by #11116
Labels
Feature: API FY25 Sprint 12 FY25 Sprint 12 (2024-12-04 - 2024-12-18) Help Wanted: Code Size: 10 A percentage of a sprint. 7 hours. Type: Bug a defect

Comments

@qqmyers
Copy link
Member

qqmyers commented Feb 23, 2024

What steps does it take to reproduce the issue? Discovered in code review of #10299:
https://github.com/IQSS/dataverse/blob/develop/src/main/java/edu/harvard/iq/dataverse/api/AbstractApiBean.java#L604 and probably

dataverse/src/main/java/edu/harvard/iq/dataverse/api/AbstractApiBean.java

Line 797 in 82585f9

protected Response permissionError( String message ) {
result in 401/Unauthorized error codes rather than (the correct) 403/Forbidden.

  • When does this issue occur?
    ~Any API call resulting in a PermissionException in the underlying command when the user does not have sufficient permission.

Which version of Dataverse are you using?
v6.1
@qqmyers qqmyers added the Type: Bug a defect label Feb 23, 2024
@qqmyers qqmyers mentioned this issue Feb 23, 2024
Merged
@sbarbosadataverse sbarbosadataverse moved this to SPRINT- NEEDS SIZING in IQSS Dataverse Project Jun 26, 2024
@DS-INRAE DS-INRAE moved this to 🔍 Interest in Recherche Data Gouv Jul 10, 2024
@qqmyers qqmyers added Size: 10 A percentage of a sprint. 7 hours. Help Wanted: Code labels Aug 26, 2024
@pdurbin pdurbin moved this from SPRINT READY to In Progress 💻 in IQSS Dataverse Project Dec 19, 2024
@pdurbin pdurbin self-assigned this Dec 19, 2024
pdurbin added a commit that referenced this issue Dec 19, 2024
@pdurbin
respond with 403 (not 401) when password good but no perms #10340
7d7414d
@pdurbin pdurbin linked a pull request Dec 19, 2024 that will close this issue
Open
@pdurbin pdurbin added the FY25 Sprint 12 FY25 Sprint 12 (2024-12-04 - 2024-12-18) label Dec 19, 2024
@pdurbin
Copy link
Member

pdurbin commented Dec 19, 2024

I made a PR:

@pdurbin pdurbin moved this from In Progress 💻 to Done 🧹 in IQSS Dataverse Project Dec 19, 2024
@pdurbin pdurbin removed their assignment Dec 19, 2024
pdurbin added a commit that referenced this issue Dec 19, 2024
@pdurbin
add release note #10340
76e27f3
pdurbin added a commit that referenced this issue Dec 20, 2024
@pdurbin
respond with 403 (not 401) when password good but no perms #10340
a90b9b2
pdurbin added a commit that referenced this issue Dec 20, 2024
@pdurbin
add release note #10340
bc7cb23
pdurbin added a commit that referenced this issue Dec 20, 2024
@pdurbin
add test to exercise change from unauth to forbidden #10340
caa00fb
pdurbin added a commit that referenced this issue Dec 20, 2024
@pdurbin
add change from 401 to 403 for /api/roles, improve docs #10340
f99d67e
pdurbin added a commit that referenced this issue Dec 20, 2024
@pdurbin
make release note more accurate, only one endpoint affected #10340
a2cb8ae
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Feature: API FY25 Sprint 12 FY25 Sprint 12 (2024-12-04 - 2024-12-18) Help Wanted: Code Size: 10 A percentage of a sprint. 7 hours. Type: Bug a defect
Projects
IQSS Dataverse Project
Status: Done 🧹
Recherche Data Gouv
Status: 🔍 Interest
Milestone
No milestone
3 participants
@pdurbin @qqmyers @sbarbosadataverse