[I] 3.5.3: authentication_handlers entries outside the new whitelist are silently dropped (breaks `{couch_httpd_auth, jwt_authentication_handler}`) [couchdb]

["Jarown (via GitHub)" <gi...@apache.org>]

Jarown opened a new issue, #6166:
URL: https://github.com/apache/couchdb/issues/6166

   ### Description
   
   After upgrading from 3.5.2 to 3.5.3, JWT authentication stopped working and all Bearer-token requests returned 401. Basic auth kept working.
   
   Our `[chttpd]` config:
   
   ```ini
   [chttpd]
   authentication_handlers = {couch_httpd_auth, jwt_authentication_handler}, {chttpd_auth, default_authentication_handler}
   require_valid_user = true
   ```
   
   #6152 changed `chttpd:set_auth_handlers/0` to map entries through a fixed whitelist. Only the short names and the `{chttpd_auth, ...}` tuples are accepted. Any other entry falls through to `authentication_handler_map(_) -> false` and is dropped without a log message.
   
   In 3.5.2, `chttpd_auth:jwt_authentication_handler/1` just delegates to `couch_httpd_auth:jwt_authentication_handler/1`, and both were exported. The configured tuple was valid and worked. The PR states that "for compatibility we still accept existing tuple forms", but this functionally equivalent tuple is no longer accepted, in a patch release.
   
   ### Steps to Reproduce
   
   1. Run CouchDB 3.5.3 with the config above and a valid `[jwt_keys]` / `[jwt_auth]` setup.
   2. `curl -H "Authorization: Bearer <valid token>" http://localhost:5984/_session`
   3. The response is a 401 (or `"authenticated"` is not `"jwt"`). The same request works on 3.5.2.
   4. `GET /_node/_local/_config/chttpd/authentication_handlers` still shows the configured value, and nothing in the log shows that the JWT handler was dropped.
   
   ### Expected Behaviour
   
   - Either keep accepting previously working tuples (for example by falling back to the old `make_arity_1_fun` behaviour for unknown `{Module, Function}` entries),
   - or at least log a warning or error at startup for each ignored entry, so a misconfiguration is visible instead of silently disabling an authentication method.
   
   ### Workaround
   
   Change the entry to `{chttpd_auth, jwt_authentication_handler}` or `jwt`.
   
   ### Your Environment
   
   - CouchDB version used: 3.5.3 (official Docker image, tag `couchdb:3.5`)
   - Operating system and version: Linux (Docker)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] 3.5.3: authentication_handlers entries outside the new whitelist are silently dropped (breaks `{couch_httpd_auth, jwt_authentication_handler}`) [couchdb]

["rnewson (via GitHub)" <gi...@apache.org>]

rnewson commented on issue #6166:
URL: https://github.com/apache/couchdb/issues/6166#issuecomment-6189127276

   ah, sorry for that. you are right. we had not anticipated that users would use the 'wrong' module for the chttpd vs httpd sections, but of course it would be possible (and would happen to do the right thing, as you are right that it's a straight delegation).
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org