Skip to content

Do not crash without www-authentication header - #1251

Merged
nicolaiarocci merged 1 commit into
pyeve:masterfrom
NotSpecial:fix-abort-crash
Apr 3, 2019
Merged

Do not crash without www-authentication header#1251
nicolaiarocci merged 1 commit into
pyeve:masterfrom
NotSpecial:fix-abort-crash

Conversation

@NotSpecial

@NotSpecial NotSpecial commented Apr 3, 2019

Copy link
Copy Markdown
Contributor

Currently, there is an issue with abort(401). Per default,the keyword argument www_authenticate is None for the UnauthorizedException, i.e. abort(401) (as described in the Werkzeug docs), and the resulting exception attribute is e.www-authenticate = (None,).

In endpoints.py#L173, this (None,) is added to the header stack, which crashes response processing in render.py#L164, as (None,) cannot be unpacked to header, value.

In our API, an automated basic auth response does not make sense, yet calling abort(401) (without the www_authenticate) is currently impossible with Eve.

In this PR, I have modified the error endpoint to only add the www_authenticate header if it is a proper header, value pair and not the (None,) default.

I'd love to add a test as well, but I don't quite know where in the test suite this would fit in best. Any pointers are appreciated, and I'll get to it.

@nicolaiarocci

Copy link
Copy Markdown
Member

@NotSpecial are you on Werkzeug 0.14.1 or 0.15.1?

@NotSpecial

NotSpecial commented Apr 3, 2019

Copy link
Copy Markdown
Contributor Author

0.15.2 actually, but I don't think they changed abort 401 again after 0.15.1

Edit: Just tried it with 0.15.1, same issue.

@NotSpecial

Copy link
Copy Markdown
Contributor Author

Update: added link to the Werkzeug docs, where the default argument www_authenticate=None is described)

@nicolaiarocci nicolaiarocci added this to the 0.8.2 milestone Apr 3, 2019
@nicolaiarocci
nicolaiarocci merged commit 26be349 into pyeve:master Apr 3, 2019
nicolaiarocci added a commit that referenced this pull request Apr 3, 2019
@nicolaiarocci

Copy link
Copy Markdown
Member

Thanks.

@NotSpecial

Copy link
Copy Markdown
Contributor Author

Awesome, thanks for merging and the fast response!

@NotSpecial
NotSpecial deleted the fix-abort-crash branch April 3, 2019 13:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants