Delegate system does not allow HTTP 401 responses with JSON-LD content

[markmatney]

I have implemented a minimal working example that demostrates this bug. Please see the commit message here for an explanation.

Steps to reproduce

1. Build the delegate here: https://github.com/markmatney/sample-java-delegate/tree/all-or-nothing-access-mwe
2. Run a local Cantaloupe with the delegate JAR on the classpath, according to the delegate README (and with the Cantaloupe config edited to point to a directory with test images)
3. Request an info.json in your browser, using any of the Image API endpoints, until you get an HTTP 401 response (the delegate randomly cycles between 200 and 401)
4. Note that for 401, an error page is returned (as was reported in Strange response #544, which this issue causes), but an info.json should be returned instead
5. Also note that this issue occurs regardless of whether the authorization logic is in preAuthorize or in authorize

I was able to get the expected behavior (info.json returned with HTTP 401) by applying the following patch to 1d15800 (although I haven't tested it thoroughly):

diff --git a/src/main/java/edu/illinois/library/cantaloupe/resource/AbstractResource.java b/src/main/java/edu/illinois/library/cantaloupe/resource/AbstractResource.java
index 7b2c04e8d..7dab7ed32 100644
--- a/src/main/java/edu/illinois/library/cantaloupe/resource/AbstractResource.java
+++ b/src/main/java/edu/illinois/library/cantaloupe/resource/AbstractResource.java
@@ -364,6 +364,9 @@ public abstract class AbstractResource {
             if (code == 401) {
                 getResponse().setHeader("WWW-Authenticate",
                         info.getChallengeValue());
+                if (getRequestContext().getLocalURI().getPath().endsWith("info.json")) {
+                    return true;
+                }
             }
             throw new ResourceException(new Status(code));
         }

Edit: a better patch

[adolski]

Thanks for reporting this, @markmatney. This seems like a pretty glaring bug and it must have been an oversight. I just pushed a commit to the release/5.0 branch that forces all 4xx responses from information endpoints to JSON-LD. Please reopen if anything seems awry.

[markmatney]

Thank you!