Operations failing with unauthorised response and "_reader access" required message.

[jthomas]

issue

I'm seeing authentication failures when attempting the GetAllDocsOperation on Linux with Swift 4. I've also tried the GetDocumentOperation and see the same issue.

2018-03-27 16:52:21.221 Test[312:a1365700] Cookie request successful
2018-03-27 16:52:21.843 Test[312:a1365700] Cookie request successful
2018-03-27 16:52:22.470 Test[312:935f8700] Cookie request successful
2018-03-27 16:52:23.094 Test[312:a0b64700] Cookie request successful
2018-03-27 16:52:23.719 Test[312:935f8700] Cookie request successful
2018-03-27 16:52:24.331 Test[312:93df9700] Cookie request successful
2018-03-27 16:52:24.954 Test[312:a1365700] Cookie request successful
2018-03-27 16:52:25.581 Test[312:a0b64700] Cookie request successful
2018-03-27 16:52:26.199 Test[312:a0b64700] Cookie request successful
2018-03-27 16:52:26.824 Test[312:a1365700] Cookie request successful
2018-03-27 16:52:27.438 Test[312:a1365700] Cookie request successful
error http(statusCode: 401, response: Optional("{\"error\":\"unauthorized\",\"reason\":\"_reader access is required for this request\"}\n"))

Running the same code on OS X works fine.

test files

Here's the sample project files I'm using to build a Swift exectuable.

• Package.swift

// swift-tools-version:4.0
// The swift-tools-version declares the minimum version of Swift required to build this package.

import PackageDescription

let package = Package(
    name: "Test",
    dependencies: [
        // Dependencies declare other packages that this package depends on.
		.package(url: "https://github.com/cloudant/swift-cloudant.git", from: "0.8.0"),
    ],
    targets: [
        // Targets are the basic building blocks of a package. A target can define a module or a test suite.
        // Targets can depend on other targets in this package, and on products in packages which this package depends on.
        .target(
            name: "Test",
            dependencies: ["SwiftCloudant"]),
    ]
)

• Sources/Test/main.swift

import SwiftCloudant
import Foundation
import CoreFoundation

let url = URL(string: "https://XXX-bluemix.cloudant.com")!
let username = "XXX-bluemix"
let password = "XXX"
let client = CouchDBClient(url:url, username: username, password: password)
let dbName = "todos"

let allDocs = GetAllDocsOperation(databaseName: "todos", rowHandler: { doc in
    print("Got document: \(doc)")
}) { response, info, error in
    if let error = error {
        print("error", error)
    } else {
        print("success")
    }
}

client.add(operation: allDocs)
CFRunLoopRun()

test steps

• swift package init --type executable
• Copy in Package.swift and main.swift from above.
• swift run Test

enviroments

OS X 👍

$ swift run Test
2018-03-27 18:35:56.520 Test[57714:14107982] Cookie request successful
Got document: ["id": dfa439be8e433779b1f04b9477b89932, "key": dfa439be8e433779b1f04b9477b89932, "value": {
    rev = "5-6f3575a4785c127c76eb657c4d7d9ae5";
}]
success
^C
[18:36:13 /tmp/Test]$ swift -v
Apple Swift version 4.0.3 (swiftlang-900.0.74.1 clang-900.0.39.2)
Target: x86_64-apple-macosx10.9

Linux 👎

For Linux, I've tested with the following Docker images openwhisk/action-swift-v4 and openwhisk/action-swift-v4.1. Same result in both enviroments.

docker run --rm -it openwhisk/action-swift-v4 bash
docker run --rm -it openwhisk/action-swift-v4.1 bash

$ swift run Test
Compile Swift Module 'Test' (1 sources)
Linking ./.build/x86_64-unknown-linux/debug/Test
2018-03-27 16:52:21.221 Test[312:a1365700] Cookie request successful
2018-03-27 16:52:21.843 Test[312:a1365700] Cookie request successful
2018-03-27 16:52:22.470 Test[312:935f8700] Cookie request successful
2018-03-27 16:52:23.094 Test[312:a0b64700] Cookie request successful
2018-03-27 16:52:23.719 Test[312:935f8700] Cookie request successful
2018-03-27 16:52:24.331 Test[312:93df9700] Cookie request successful
2018-03-27 16:52:24.954 Test[312:a1365700] Cookie request successful
2018-03-27 16:52:25.581 Test[312:a0b64700] Cookie request successful
2018-03-27 16:52:26.199 Test[312:a0b64700] Cookie request successful
2018-03-27 16:52:26.824 Test[312:a1365700] Cookie request successful
2018-03-27 16:52:27.438 Test[312:a1365700] Cookie request successful
error http(statusCode: 401, response: Optional("{\"error\":\"unauthorized\",\"reason\":\"_reader access is required for this request\"}\n"))
^C\
$ swift -v
Swift version 4.0.3 (swift-4.0.3-RELEASE)
Target: x86_64-unknown-linux-gnu

$  swift run Test
2018-03-27 16:31:47.528 Test[575:7d60a700] Cookie request successful
2018-03-27 16:31:48.156 Test[575:7c9f8700] Cookie request successful
2018-03-27 16:31:48.781 Test[575:7d60a700] Cookie request successful
2018-03-27 16:31:49.419 Test[575:7d60a700] Cookie request successful
2018-03-27 16:31:50.045 Test[575:7d60a700] Cookie request successful
2018-03-27 16:31:50.673 Test[575:7d60a700] Cookie request successful
2018-03-27 16:31:51.309 Test[575:7d60a700] Cookie request successful
2018-03-27 16:31:51.938 Test[575:7de0b700] Cookie request successful
2018-03-27 16:31:52.571 Test[575:7d60a700] Cookie request successful
2018-03-27 16:31:53.205 Test[575:7de0b700] Cookie request successful
2018-03-27 16:31:53.828 Test[575:7c9f8700] Cookie request successful
error http(statusCode: 401, response: Optional("{\"error\":\"unauthorized\",\"reason\":\"_reader access is required for this request\"}\n"))
swift -v
Swift version 4.1-dev (LLVM 1c8b50929b, Clang 420ae40df6, Swift ec821efb01)
Target: x86_64-unknown-linux-gnu

[tomblench]

@jthomas that's a bit odd. My only guess is that somehow the cookie storage on linux is different and despite us setting the cookie for the session, it never gets sent in the request for _all_docs. That's why you see the 10 retries before it finally fails.

I'll have a dig into it later when I get time. If you have a local couch instance you could try to reproduce this against the local instance using http and using wireshark or similar to see the cookie exchange. Although my guess is that each time we ask for the cookie we receive the set-cookie header, but we never manage to send it on the _all_docs request.

[ianpartridge]

Are you talking about HTTPCookieStorage? If so, @mamabusi implemented that on Linux and can hopefully help...

[tomblench]

Yes it would seem to be related to HTTPCookieStorage. I now realise that this affects all requests and not just _all_docs. We didn't catch it before because we normally run the linux tests against a local couch which does not require any form of authentication.

I tried testing this by putting a debug line here, after the cookie is retrieved. I added print(HTTPCookieStorage.shared.cookies) and the result is always an empty list: Optional([]).

So it seems to me that the URLSession isn't saving the cookies to the shared cookie store when it receives them. Our URLSession appears to be set up correctly, as it is the default type (not ephemeral) and uses the shared cookie store: see here. I tried changing config.httpCookieAcceptPolicy = .onlyFromMainDocumentDomain to config.httpCookieAcceptPolicy = .always in case it would make a difference but it didn't.

I had a quick look in the swift jira for anything relevant but couldn't see anything.

[ianpartridge]

Thanks for the info. @mamabusi please take a look at this...

[mamabusi]

Thanks for the info @jthomas and @tomblench . Will look into this and update the findings.

[mamabusi]

Currently, URLSession does not save the cookies sent. This has not been implemented yet.
Will get started on the implementation right away.

[tomblench]

Thanks @mamabusi .

Closing as this is not a bug in our library.

[jthomas]

@mamabusi Thanks for the info, is there an issue I can follow to know when this is resolved?

[mamabusi]

@jthomas I have created an issue here: https://bugs.swift.org/browse/SR-7338 for your tracking.