Do not crash without www-authentication header - #1251
Merged
Conversation
Member
|
@NotSpecial are you on Werkzeug 0.14.1 or 0.15.1? |
Contributor
Author
|
0.15.2 actually, but I don't think they changed abort 401 again after 0.15.1 Edit: Just tried it with 0.15.1, same issue. |
Contributor
Author
|
Update: added link to the Werkzeug docs, where the default argument |
Member
|
Thanks. |
Contributor
Author
|
Awesome, thanks for merging and the fast response! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently, there is an issue with
abort(401). Per default,the keyword argumentwww_authenticateisNonefor theUnauthorizedException, i.e.abort(401)(as described in the Werkzeug docs), and the resulting exception attribute ise.www-authenticate = (None,).In endpoints.py#L173, this
(None,)is added to the header stack, which crashes response processing in render.py#L164, as(None,)cannot be unpacked toheader, value.In our API, an automated basic auth response does not make sense, yet calling
abort(401)(without thewww_authenticate) is currently impossible with Eve.In this PR, I have modified the error endpoint to only add the
www_authenticateheader if it is a properheader, valuepair and not the(None,)default.I'd love to add a test as well, but I don't quite know where in the test suite this would fit in best. Any pointers are appreciated, and I'll get to it.