Always return 401 for not valid tokens #49736
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Return a 401 in all cases when a request is submitted with an access token that we can't consume. Before this change, we would throw a 500 when a request came in with an access token that we had generated but was then invalidated/expired and deleted from the tokens index. Resolves: elastic#38866
jkakavas
added
>bug
:Security/Authentication
Collaborator
|
Pinging @elastic/es-security (:Security/Authentication) |
albertzaharovits
approved these changes
Dec 6, 2019
Contributor
albertzaharovits
left a comment
albertzaharovits
left a comment
There was a problem hiding this comment.
LGTM , a missing token document is more likely a sign of an invalid token (401 Unauthorized) than of a bug which might have deleted or otherwise erroneously stored the token document, in both the encrypted and the hashed token cases.
jkakavas
added a commit
to jkakavas/elasticsearch
that referenced
this pull request
Dec 10, 2019
Return a 401 in all cases when a request is submitted with an access token that we can't consume. Before this change, we would throw a 500 when a request came in with an access token that we had generated but was then invalidated/expired and deleted from the tokens index. Resolves: elastic#38866
jkakavas
added a commit
that referenced
this pull request
Dec 11, 2019
Return a 401 in all cases when a request is submitted with an access token that we can't consume. Before this change, we would throw a 500 when a request came in with an access token that we had generated but was then invalidated/expired and deleted from the tokens index. Resolves: #38866 Backport of #49736
jkakavas
added a commit
to jkakavas/elasticsearch
that referenced
this pull request
Dec 13, 2019
This test was fixed as part of elastic#49736 so that it used a TokenService mock instance that was enabled, so that token verification fails because the token is invalid and not because the token service is not enabled. When the randomly generated token we send, decodes to being of version > 7.2 , we need to have mocked a GetResponse for the call that TokenService#getUserTokenFromId will make, otherwise this hangs and times out.
jkakavas
added a commit
that referenced
this pull request
Dec 13, 2019
This test was fixed as part of #49736 so that it used a TokenService mock instance that was enabled, so that token verification fails because the token is invalid and not because the token service is not enabled. When the randomly generated token we send, decodes to being of version > 7.2 , we need to have mocked a GetResponse for the call that TokenService#getUserTokenFromId will make, otherwise this hangs and times out.
jkakavas
added a commit
to jkakavas/elasticsearch
that referenced
this pull request
Dec 13, 2019
This test was fixed as part of elastic#49736 so that it used a TokenService mock instance that was enabled, so that token verification fails because the token is invalid and not because the token service is not enabled. When the randomly generated token we send, decodes to being of version > 7.2 , we need to have mocked a GetResponse for the call that TokenService#getUserTokenFromId will make, otherwise this hangs and times out.
jkakavas
added a commit
that referenced
this pull request
Dec 13, 2019
This test was fixed as part of #49736 so that it used a TokenService mock instance that was enabled, so that token verification fails because the token is invalid and not because the token service is not enabled. When the randomly generated token we send, decodes to being of version > 7.2 , we need to have mocked a GetResponse for the call that TokenService#getUserTokenFromId will make, otherwise this hangs and times out.
SivagurunathanV
pushed a commit
to SivagurunathanV/elasticsearch
that referenced
this pull request
Jan 23, 2020
Return a 401 in all cases when a request is submitted with an access token that we can't consume. Before this change, we would throw a 500 when a request came in with an access token that we had generated but was then invalidated/expired and deleted from the tokens index. Resolves: elastic#38866
SivagurunathanV
pushed a commit
to SivagurunathanV/elasticsearch
that referenced
this pull request
Jan 23, 2020
This test was fixed as part of elastic#49736 so that it used a TokenService mock instance that was enabled, so that token verification fails because the token is invalid and not because the token service is not enabled. When the randomly generated token we send, decodes to being of version > 7.2 , we need to have mocked a GetResponse for the call that TokenService#getUserTokenFromId will make, otherwise this hangs and times out.
This was referenced Feb 3, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Return a 401 in all cases when a request is submitted with an
access token that we can't consume. Before this change, we would
throw a 500 when a request came in with an access token that we
had generated but was then invalidated/expired and deleted from
the tokens index.
Resolves: #38866