Error while trying to authorize the request when scopes
filed is not configured
#972
Labels
Area/Security
Issues related to stdlib security
module/auth
module/http
Points/1
Type/Bug
Verson/SwanLakeDump
All issues planned for Swan Lake GA release
Milestone
Description
When a HTTP service is configured with
auth
annotation ishttp:ServiceConfig
, it should try to authenticate and authorize the inbound request. When thescopes
field of theauth
annotation is not provided, it should avoid the authorization phase. Currently it executes the authorization phase even though thescopes
field is not provided. The logic should be fixed for that use case.Steps to reproduce:
curl https://localhost:9090/whoiam -k \ -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsICJ0eXAiOiJKV1QiLCAia2lkIjoiTlRBeFptTXhORE15WkRnM01UVTFaR00wTXpFek9ESmhaV0k0TkRObFpEVTFPR0ZrTmpGaU1RIn0.eyJpc3MiOiJiYWxsZXJpbmEiLCAic3ViIjoiYWRtaW4iLCAiYXVkIjoidkV3emJjYXNKVlFtMWpWWUhVSENqaHhaNHRZYSIsICJqdGkiOiJmMTJhYmE1Zi03MGQ2LTQ4OWUtODJkMi0yNTI1YzE1OGVkY2YiLCAiZXhwIjoxNjEzMjM0NDk1LCAibmJmIjoxNjEzMjMwODk1LCAiaWF0IjoxNjEzMjMwODk1fQ.Y5uu3BrQLDVIfkwR2b82Jv_KWpwYP2Wxtm22ufXKRV0A7mhZp0ljqYskBpJHNx6SR7D5Kxw7SOlhuU9BWQT_ZZNeHc2xIkZGZZyx3WwcAC8cFvM-XXJhkuRQyEdJ5uZtRl89ZbJ4PKLsc9_ENR5jgwfQNv3B1KOP_tG5KUtBt2VfIrfLcP3R9Pr6ZtYYA0AZxi7zB-lY6xT5H2OdecaSCNuykvsFL-pwfE5VP4E2v3ZukP79kT0hi6m4X0B93FKQBdkEHwGJVZW1P-JcQMybgfty9pDueAmWpTzZs5JaXsy32bB_DAIfEyYiKsS20e7Dr1NEOuAFpcaxgOwR7X6T6A'
Affected Versions:
Ballerina SL Alpha2
Originally reported by Kirill Keker at Slack [1].
[1] https://ballerina-platform.slack.com/archives/C47EAELR1/p1613232067181500
The text was updated successfully, but these errors were encountered: