API returns 401 instead of 403 when an authenticated user is denied
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 5.3k
- Forks
- 1.4k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 62
Description
Discussed in https://github.com/solidusio/solidus/discussions/4819
Originally posted by Zigreal December 29, 2022
Hi everybody! Can you please tell me if it makes sense that rescue_from CanCan::AccessDenied, with: :unauthorized returns 401 when the user is denied an action? For example, "authorize! :update, @order, order_token" - if I set a condition in the rights set that I can't update the order, then I'll get 401, not 403, because the controller has rescue_from CanCan::AccessDenied, with: :unauthorized. How can i get 403 in normal way?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the controller's rescue_from CanCan::AccessDenied, with: :unauthorized handling and the authorize! :update, @order, order_token example described in the issue. Trace how an authenticated user denied an action is mapped to an HTTP status, then verify that the expected result is 403 rather than 401.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rails, ruby
- Domain
- api, authorization
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100