Reading non-existing policy returns "ACL Not found" in a 403 Forbidden
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 39
Description
#### Overview of the Issue
Reading non-existing policy returns "ACL Not found" in a 403 Forbidden.
```
curl -v -H "X-Consul-Token: " https://consul.example.com/v1/acl/policy/name/non-existing-policy
(...)
> GET /v1/acl/policy/namenon-existing-policy HTTP/2
> Host: consul.example.com
> user-agent: curl/7.75.0
> accept: */*
> x-consul-token:
>
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
< HTTP/2 403
< server: nginx/1.18.0
< date: Fri, 26 Mar 2021 15:11:40 GMT
< content-type: text/plain; charset=utf-8
< content-length: 13
< vary: Accept-Encoding
< x-consul-default-acl-policy: deny
< x-consul-index: 3970308
< x-consul-knownleader: true
< x-consul-lastcontact: 0
< strict-transport-security: max-age=31536000; includeSubDomains; preload
ACL not found
```
### Consul info for both Client and Server
Client info
```
The client is not a consul agent. But rather code invoking the REST API.
```
Server info
```
Consul server is on version 1.9.3.
```
Contributor guide
Research direction
Start by reproducing the request against the ACL policy read endpoint described in the issue, using a valid token and a nonexistent policy name. Trace the Consul server path handling that request and its error response; done means the nonexistent-policy case has the intended status and error behavior, with coverage added where the project’s existing ACL tests belong.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, authorization
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100