spring-projects / spring-projects/spring-security
SEC-3195: Authentication Entry point in case of JS clients ignores authException details
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Muhammad (Migrated from SEC-3195) said:
In the HttpBasicConfigurer#HttpBasicConfigurer contractor, spring security set the auth entry point to HttpStatusEntryPoint in case of JS apps.
Why not also send the exception message with 401 code to the client?
IMHO; In most case the client (regardless of it is web/js/mobile) need to know the exact auth error message from server.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at HttpBasicConfigurer#HttpBasicConfigurer and the HttpStatusEntryPoint path used for JavaScript clients; trace how authException details are currently handled. Determine the expected 401 response content and verify that the authentication error message reaches the client without changing the status code.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100