apache / apache/couchdb

Basic Authentication for `_utils` does not work if `require_valid_user_except_for_up` is set

Open
#5,186 2 comments 1 reaction 0 assignees View on GitHub
bug needs-triage
Dominant language
Erlang
Stars
7k
Forks
1.1k
Avg merge
1d 16h
Merged PRs (30d)
9

Description

[NOTE]: # ( ^^ Provide a general summary of the issue in the title above. ^^ )

## Description
When setting `require_valid_user_except_for_up` instead of `require_valid_user` in the CouchDB configuration, the system does not prompt for username and password when accessing the `_utils` endpoint. Instead, a 401 is returned. `{"error":"unauthorized","reason":"Authentication required."}`

When changing the configuration back to `require_valid_user`, the basic authentication prompt appears as expected.

[NOTE]: # ( Describe the problem you're encountering. )
[TIP]: # ( Do NOT give us access or passwords to your actual CouchDB! )

## Steps to Reproduce

1. Set `require_valid_user_except_for_up = true` in local.ini
2. Restart CouchDB to apply the configuration change.
3. Attempt to access the `_utils` endpoint (e.g., `http://localhost:5984/_utils`).

[NOTE]: # ( Include commands to reproduce, if possible. curl is preferred. )

## Expected Behaviour
The `_utils` endpoint should prompt for authentication

[NOTE]: # ( Tell us what you expected to happen. )

## Your Environment
[TIP]: # ( Include as many relevant details about your environment as possible. )
[TIP]: # ( You can paste the output of curl http://YOUR-COUCHDB:5984/ here. )

* CouchDB version used: 3.3 (Docker)
* Browser name and version: Firefox
* Operating system and version: MacOS

```
{
"couchdb": "Welcome",
"version": "3.3.3",
"git_sha": "40afbcfc7",
"uuid": "3a7f2e8d1c9b4f6e0d5a2c8b7f3e1d9a",
"features": [
"access-ready",
"partitioned",
"pluggable-storage-engines",
"reshard",
"scheduler"
],
"vendor": {
"name": "The Apache Software Foundation"
}
}
```

local.ini
```
[couchdb]
single_node=true
uuid = 3a7f2e8d1c9b4f6e0d5a2c8b7f3e1d9a

[chttpd]
require_valid_user_except_for_up = true
bind_address = any
authentication_handlers = {chttpd_auth, jwt_authentication_handler}, {chttpd_auth, cookie_authentication_handler}, {chttpd_auth, default_authentication_handler}
enable_cors = true

[jwt_keys]
....

[jwt_auth]
roles_claim_path = cognito:groups

[couch_peruser]
enable = true

[admins]
admin = -pbkdf2-...

[cors]
origins = *
headers = accept, authorization, content-type, origin, referer
credentials = true
methods = GET, PUT, POST, HEAD, DELETE

```

Contributor guide

Open the contributing guide

Research direction

Reproduce the behavior using the local.ini configuration with require_valid_user_except_for_up enabled, then access the _utils endpoint and compare it with require_valid_user. Trace the authentication handling for _utils and verify that the endpoint prompts for credentials instead of returning a 401 Authentication required response.

Written by the indexing model from the issue text.

Assessment

Tech stack
erlang
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.