fix(oauth2): add missing www-authenticate headers #11833
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This was referenced Oct 24, 2023
This was referenced Oct 24, 2023
bungle
reviewed
Oct 25, 2023
kong/plugins/oauth2/access.lua
Outdated
| @@ -831,6 +831,11 @@ local function retrieve_token(conf, access_token) | |||
| [ERROR] = "invalid_token", | |||
| error_description = "The access token is global, but the current " .. | |||
| "plugin is configured without 'global_credentials'", | |||
| }, | |||
| { | |||
| ["WWW-Authenticate"] = 'Bearer realm="service" error=' .. | |||
There was a problem hiding this comment.
Did we decide to hardcode realm=service? Or should it be dynamic? Or is there no good way to figure it out? Which would me we’d need to add config.realm so that it could be specified?
nowNick
force-pushed
the
feat/implement-missing-www-authenticate-headers-oauth2
branch
from
feaa52c
to
db8982b
Compare
github-actions
bot
added
schema-change-noteworthy
cherry-pick kong-ee
nowNick
force-pushed
the
feat/implement-missing-www-authenticate-headers-oauth2
branch
3 times, most recently
from
166d5b3
to
466acab
Compare
nowNick
force-pushed
the
feat/implement-missing-www-authenticate-headers-oauth2
branch
from
466acab
to
6831da1
Compare
nowNick
force-pushed
the
feat/implement-missing-www-authenticate-headers-oauth2
branch
from
6831da1
to
bded47d
Compare
hanshuebner
approved these changes
May 27, 2024
jschmid1
approved these changes
May 31, 2024
nowNick
removed
the
cherry-pick kong-ee
nowNick
force-pushed
the
feat/implement-missing-www-authenticate-headers-oauth2
branch
from
c3e6432
to
5b40a68
Compare
github-actions
bot
added
the
cherry-pick kong-ee
jschmid1
deleted the
feat/implement-missing-www-authenticate-headers-oauth2
branch
github-actions
bot
added
the
incomplete-cherry-pick
kikito
removed
the
incomplete-cherry-pick
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
When kong returns
401 Unauthorizedresponse it should returnWWW-Authenticateheader with proper challenge. Oauth2 was missing this header on some responses.Related PRs:
RFCs & Materials
Checklist
changelog/unreleased/kongorskip-changeloglabel added on PR if changelog is unnecessary. README.mdThere is a user-facing docs PR against https://github.com/Kong/docs.konghq.com - PUT DOCS PR HEREFull changelog
WWW-Authenticateheader to all oauth2 401 responseIssue reference