Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add 'WWW-Authenticate' header for reponses w/ status code 401 Unauthorized. #588

Merged
merged 1 commit into from
Oct 13, 2015
Merged

Add 'WWW-Authenticate' header for reponses w/ status code 401 Unauthorized. #588

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions kong/plugins/basic-auth/access.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,7 @@ function _M.execute(conf)
-- If both headers are missing, return 401
if not (ngx.req.get_headers()[AUTHORIZATION] or ngx.req.get_headers()[PROXY_AUTHORIZATION]) then
ngx.ctx.stop_phases = true
ngx.header["WWW-Authenticate"] = "Basic realm=\""..constants.NAME.."\""
return responses.send_HTTP_UNAUTHORIZED()
end

Expand Down
1 change: 1 addition & 0 deletions kong/plugins/key-auth/access.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,7 @@ function _M.execute(conf)
-- No key found in the request's headers or parameters
if not key_found then
ngx.ctx.stop_phases = true
ngx.header["WWW-Authenticate"] = "Key realm=\""..constants.NAME.."\""
return responses.send_HTTP_UNAUTHORIZED("No API Key found in headers, body or querystring")
end

Expand Down
11 changes: 7 additions & 4 deletions spec/plugins/basic-auth/access_spec.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
local spec_helper = require "spec.spec_helpers"
local http_client = require "kong.tools.http_client"
local constants = require "kong.constants"
local cjson = require "cjson"

local PROXY_URL = spec_helper.PROXY_URL
Expand Down Expand Up @@ -32,10 +33,11 @@ describe("Authentication Plugin", function()

describe("Basic Authentication", function()

it("should return invalid credentials when the credential is missing", function()
local response, status = http_client.get(PROXY_URL.."/get", {}, {host = "basicauth.com"})
it("should return invalid credentials and www-authenticate header when the credential is missing", function()
local response, status, headers = http_client.get(PROXY_URL.."/get", {}, {host = "basicauth.com"})
local body = cjson.decode(response)
assert.equal(401, status)
assert.equal(headers["www-authenticate"], "Basic realm=\""..constants.NAME.."\"")
assert.equal("Unauthorized", body.message)
end)

Expand Down Expand Up @@ -67,10 +69,11 @@ describe("Authentication Plugin", function()
assert.equal("Invalid authentication credentials", body.message)
end)

it("should reply 401 when authorization is missing", function()
local response, status = http_client.get(PROXY_URL.."/get", {}, {host = "basicauth.com", authorization123 = "Basic dXNlcm5hbWU6cGFzc3dvcmQ="})
it("should reply 401 and www-authenticate header when authorization is missing", function()
local response, status, headers = http_client.get(PROXY_URL.."/get", {}, {host = "basicauth.com", authorization123 = "Basic dXNlcm5hbWU6cGFzc3dvcmQ="})
local body = cjson.decode(response)
assert.equal(401, status)
assert.equal(headers["www-authenticate"], "Basic realm=\""..constants.NAME.."\"")
assert.equal("Unauthorized", body.message)
end)

Expand Down
31 changes: 19 additions & 12 deletions spec/plugins/key-auth/access_spec.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
local spec_helper = require "spec.spec_helpers"
local http_client = require "kong.tools.http_client"
local constants = require "kong.constants"
local cjson = require "cjson"

local STUB_GET_URL = spec_helper.STUB_GET_URL
Expand Down Expand Up @@ -35,10 +36,11 @@ describe("Authentication Plugin", function()

describe("Query Authentication", function()

it("should return invalid credentials when the credential is missing", function()
local response, status = http_client.get(STUB_GET_URL, {}, {host = "keyauth1.com"})
it("should return invalid credentials and www-authenticate header when the credential is missing", function()
local response, status, headers = http_client.get(STUB_GET_URL, {}, {host = "keyauth1.com"})
local body = cjson.decode(response)
assert.equal(401, status)
assert.equal(headers["www-authenticate"], "Key realm=\""..constants.NAME.."\"")
assert.equal("No API Key found in headers, body or querystring", body.message)
end)

Expand All @@ -49,24 +51,27 @@ describe("Authentication Plugin", function()
assert.equal("Invalid authentication credentials", body.message)
end)

it("should reply 401 when the credential parameter is missing", function()
local response, status = http_client.get(STUB_GET_URL, {apikey123 = "apikey123"}, {host = "keyauth1.com"})
it("should reply with 401 and www-authenticate header when the credential parameter is missing", function()
local response, status, headers = http_client.get(STUB_GET_URL, {apikey123 = "apikey123"}, {host = "keyauth1.com"})
local body = cjson.decode(response)
assert.equal(401, status)
assert.equal(headers["www-authenticate"], "Key realm=\""..constants.NAME.."\"")
assert.equal("No API Key found in headers, body or querystring", body.message)
end)

it("should reply 401 when the credential parameter name is wrong in GET", function()
local response, status = http_client.get(STUB_GET_URL, {apikey123 = "apikey123"}, {host = "keyauth1.com"})
it("should reply 401 and www-authenticate header when the credential parameter name is wrong in GET", function()
local response, status, headers = http_client.get(STUB_GET_URL, {apikey123 = "apikey123"}, {host = "keyauth1.com"})
local body = cjson.decode(response)
assert.equal(401, status)
assert.equal(headers["www-authenticate"], "Key realm=\""..constants.NAME.."\"")
assert.equal("No API Key found in headers, body or querystring", body.message)
end)

it("should reply 401 when the credential parameter name is wrong in POST", function()
local response, status = http_client.post(STUB_POST_URL, {apikey123 = "apikey123"}, {host = "keyauth1.com"})
it("should reply 401 and www-authenticate header when the credential parameter name is wrong in POST", function()
local response, status, headers = http_client.post(STUB_POST_URL, {apikey123 = "apikey123"}, {host = "keyauth1.com"})
local body = cjson.decode(response)
assert.equal(401, status)
assert.equal(headers["www-authenticate"], "Key realm=\""..constants.NAME.."\"")
assert.equal("No API Key found in headers, body or querystring", body.message)
end)

Expand All @@ -77,17 +82,19 @@ describe("Authentication Plugin", function()
assert.equal("apikey123", parsed_response.queryString.apikey)
end)

it("should reply 401 when the credential parameter name is wrong in GET header", function()
local response, status = http_client.get(STUB_GET_URL, {}, {host = "keyauth1.com", apikey123 = "apikey123"})
it("should reply 401 and www-authenticate header when the credential parameter name is wrong in GET header", function()
local response, status, headers = http_client.get(STUB_GET_URL, {}, {host = "keyauth1.com", apikey123 = "apikey123"})
local body = cjson.decode(response)
assert.equal(401, status)
assert.equal(headers["www-authenticate"], "Key realm=\""..constants.NAME.."\"")
assert.equal("No API Key found in headers, body or querystring", body.message)
end)

it("should reply 401 when the credential parameter name is wrong in POST header", function()
local response, status = http_client.post(STUB_POST_URL, {}, {host = "keyauth1.com", apikey123 = "apikey123"})
it("should reply 401 and www-authenticate header when the credential parameter name is wrong in POST header", function()
local response, status, headers = http_client.post(STUB_POST_URL, {}, {host = "keyauth1.com", apikey123 = "apikey123"})
local body = cjson.decode(response)
assert.equal(401, status)
assert.equal(headers["www-authenticate"], "Key realm=\""..constants.NAME.."\"")
assert.equal("No API Key found in headers, body or querystring", body.message)
end)

Expand Down