This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new acc2f01395 If the Jakarta Authentication fails with an exception, set
a 500 status
acc2f01395 is described below
commit acc2f01395f895980f5d8a64573fcc1bade13369
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Thu Sep 19 13:25:24 2024 +0100
If the Jakarta Authentication fails with an exception, set a 500 status
Depending on what fails where, the status may not be set or may be set
incorrectly.
---
java/org/apache/catalina/authenticator/AuthenticatorBase.java | 2 ++
webapps/docs/changelog.xml | 5 +++++
2 files changed, 7 insertions(+)
diff --git a/java/org/apache/catalina/authenticator/AuthenticatorBase.java
b/java/org/apache/catalina/authenticator/AuthenticatorBase.java
index ba5e1baa4b..db467ba4e9 100644
--- a/java/org/apache/catalina/authenticator/AuthenticatorBase.java
+++ b/java/org/apache/catalina/authenticator/AuthenticatorBase.java
@@ -803,6 +803,8 @@ public abstract class AuthenticatorBase extends ValveBase
implements Authenticat
authStatus =
state.serverAuthContext.validateRequest(state.messageInfo, client, null);
} catch (AuthException e) {
log.debug(sm.getString("authenticator.loginFail"), e);
+ // Need to explicitly set the return code as the ServerAuthContext
may not have done.
+ response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
return false;
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 2367fb89a6..310f6fd041 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -117,6 +117,11 @@
creates one <code>GenericPrincipal</code> in the <code>Subject</code>.
(markt)
</fix>
+ <fix>
+ If the Jakarta Authentication process fails with an Exception,
+ explicitly set the HTTP response status to 500 as the
+ <code>ServerAuthContext</code> may not have set it. (markt)
+ </fix>
</changelog>
</subsection>
</section>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
