[jira] [Commented] (COUCHDB-3084) "authenticated" property is set even when no authentication occurs

["ASF GitHub Bot (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/COUCHDB-3084?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15396177#comment-15396177 ] 

ASF GitHub Bot commented on COUCHDB-3084:
-----------------------------------------

GitHub user rnewson opened a pull request:

    https://github.com/apache/couchdb-couch/pull/189

    Don't set "authenticated" if party_mode_handler sets user context

    Patch suggested by Ilya.
    
    COUCHDB-3084

You can merge this pull request into a Git repository by running:

    $ git pull https://github.com/cloudant/couchdb-couch 3084-authenticated

Alternatively you can review and apply these changes as the patch at:

    https://github.com/apache/couchdb-couch/pull/189.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #189
    
----
commit 4e7b6265b3be88bed97572b50a412b470bf680d1
Author: Robert Newson <rn...@apache.org>
Date:   2016-07-27T19:07:23Z

    Don't set "authenticated" if party_mode_handler sets user context
    
    Patch suggested by Ilya.
    
    COUCHDB-3084

----


> "authenticated" property is set even when no authentication occurs
> ------------------------------------------------------------------
>
>                 Key: COUCHDB-3084
>                 URL: https://issues.apache.org/jira/browse/COUCHDB-3084
>             Project: CouchDB
>          Issue Type: Bug
>            Reporter: Robert Newson
>
> The "authenticated" property from /_session should only appear when authentication has occurred.
> In 2.0 we extracted the 'admin party' handling into its own handler and this introduced the side-effect that all GET's to /_session are handled by an authentication handler.
> chttpd:maybe_set_handler makes the assumption that if a handler sets #httpd.user_ctx to a #user_ctx record that authentication has taken place. This is not always true.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)