Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Incorrect 401 vs 403 error codes #9347

Open
FelixMalfait opened this issue Jan 4, 2025 · 4 comments · May be fixed by #9370
Open

Incorrect 401 vs 403 error codes #9347

FelixMalfait opened this issue Jan 4, 2025 · 4 comments · May be fixed by #9370

Comments

@FelixMalfait
Copy link
Member

401 Unauthorized should be used when the user isn't authenticated (i.e. login/pwd refused, no jwt, expired jwt, or wrong jwt...)
403 Forbidden should be used when the user is properly identified but doesn't have access to the resource

Today we send 403 for unauthenticated errors and other where we should send a 401 instead ; And for AuthExceptionCode.FORBIDDEN_EXCEPTION we send a 403...

See also:
https://stackoverflow.com/questions/45153773/correct-http-code-for-authentication-token-expiry-401-or-403

The fix should mostly be done in these files:
Image

But we should check the impact on the frontend application (token renewal, etc.), for example here:

Image Image
@FelixMalfait FelixMalfait mentioned this issue Jan 4, 2025
Open
@yadavshubham01
Copy link
Contributor

hey @FelixMalfait i want work on this issue??

@FelixMalfait
Copy link
Member Author

Hey @yadavshubham01 sure thank you! Some of your previous contributions were done a bit quickly so make sure to think this one through. What would be great would be to have a good/clear PR description where you explain if you had any doubts during implementation, record a short video that show the new code and that it doesn't break frontend, etc. Thanks

@yadavshubham01
Copy link
Contributor

hey @FelixMalfait i think we get 403 for Unauthorized and 401 for AuthExceptionCode.FORBIDDEN_EXCEPTION because this Image

@yadavshubham01 yadavshubham01 linked a pull request Jan 6, 2025 that will close this issue
Open
@yadavshubham01
Copy link
Contributor

hey @FelixMalfait i just opened pull request you can review it #9370

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
Product development ✅
Status: 🆕 New
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Proper HTTP Status Code Usage for Authentication and Authorization Errors yadavshubham01/twenty
2 participants
@FelixMalfait @yadavshubham01