You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@couchdb.apache.org by ja...@apache.org on 2022/09/01 20:46:59 UTC
[couchdb] 02/02: Maybe return bad_content_type on _session POST
This is an automated email from the ASF dual-hosted git repository.
jaydoane pushed a commit to branch session-require-content-type
in repository https://gitbox.apache.org/repos/asf/couchdb.git
commit b68f6310b50cb15225358016fee91832b533a964
Author: Jay Doane <ja...@apache.org>
AuthorDate: Thu Sep 1 13:38:44 2022 -0700
Maybe return bad_content_type on _session POST
Currently, when POSTing to `/_session` with a Content-Type header
other than either `application/x-www-form-urlencoded` or
`application/json`, the error response can be surprising.
This changes the response to 415 `bad_content_type` when it's not one
of the above.
---
src/couch/src/couch_httpd_auth.erl | 5 ++++-
src/couch/test/eunit/couchdb_auth_tests.erl | 15 +++++++++++++++
2 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/src/couch/src/couch_httpd_auth.erl b/src/couch/src/couch_httpd_auth.erl
index cc02a1e9d..4412222be 100644
--- a/src/couch/src/couch_httpd_auth.erl
+++ b/src/couch/src/couch_httpd_auth.erl
@@ -459,7 +459,10 @@ handle_session_req(#httpd{method = 'POST', mochi_req = MochiReq} = Req, AuthModu
Pairs
);
_ ->
- []
+ throw({bad_ctype, <<"Content-Type must be "
+ "'application/x-www-form-urlencoded' or "
+ "'application/json'">>}
+ )
end,
UserName = ?l2b(extract_username(Form)),
Password = ?l2b(couch_util:get_value("password", Form, "")),
diff --git a/src/couch/test/eunit/couchdb_auth_tests.erl b/src/couch/test/eunit/couchdb_auth_tests.erl
index dfb22dc25..ba652a059 100644
--- a/src/couch/test/eunit/couchdb_auth_tests.erl
+++ b/src/couch/test/eunit/couchdb_auth_tests.erl
@@ -34,6 +34,7 @@ auth_test_() ->
Tests = [
fun should_return_username_on_post_to_session/2,
fun should_not_return_authenticated_field/2,
+ fun should_return_bad_content_type_appropriately/2,
fun should_return_list_of_handlers/2
],
RequireValidUserTests = [
@@ -85,6 +86,20 @@ should_return_username_on_post_to_session(_PortType, Url) ->
end
).
+should_return_bad_content_type_appropriately(_PortType, Url) ->
+ ?_assertEqual(
+ <<"bad_content_type">>,
+ begin
+ {ok, 415, _, Body} = test_request:post(
+ Url,
+ [{"Content-Type", ""}],
+ []
+ ),
+ #{<<"error">> := Error} = jiffy:decode(Body, [return_maps]),
+ Error
+ end
+ ).
+
should_not_return_authenticated_field(_PortType, Url) ->
?_assertThrow(
{not_found, _},