Compojure incorrectly returns a body for an HEAD method on a 401 response.

[brown131]

According to RFC-2616: "The HEAD method is identical to GET except that the server MUST NOT return a message-body in the response. " (https://w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.4). However, when a HEAD method returns an HTTP 401 Unauthorized response it returns a body "access denied". This breaks, in particular, the Cyberduck client app, which expects the server to be well-behaved.

[weavejester]

Compojure doesn't handle authorisation. It sounds like the problem exists in some other middleware you're using.

[brown131]

Yes. The issue appears to be in remvee/ring-basic-authorization. Sorry about that.