Allow returning HTTP 403 (Forbidden) instead of only 401

Question

Allow returning HTTP 403 (Forbidden) instead of only 401

mimetnet opened this issue 8 years ago · comments

It would be great if the "onPostAuth" handler could support returning 403 (Forbidden). This would help API client's distinguish between Authentication and Authorization Failures.

This could be a config option to either hard-code the result for RbacCore.DENY, or allow a function to specify.

I would be more than happy to make the change if you are willing to accept a patch.

Please let me know.

Francisco Gouveia · Answer 1 · Tue Mar 01 2016 16:05:04 GMT+0800 (China Standard Time)

Response code 403 is the correct response code, because it is deciding only about authorization and not about authentication. My terrible mistake :)

I will make it a configurable parameter for the deny and undetermined cases, with the current default 401 to avoid breaking changes. I will still assign this issue for a future major release, where 403 should become the default.

Francisco Gouveia · Answer 2 · Tue Mar 01 2016 16:26:33 GMT+0800 (China Standard Time)

Version 2.0.1 released. Update your dependencies and check here how to use it.

Matthew Metnetsky · Answer 3 · Tue Mar 01 2016 23:35:19 GMT+0800 (China Standard Time)

Thank you very much @franciscogouveia. This is great!