Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

API: Requests to Org with incorrect token return empty array #24439

Closed
oyeaussie opened this issue Apr 30, 2023 · 0 comments · Fixed by #25701
Closed

API: Requests to Org with incorrect token return empty array #24439

oyeaussie opened this issue Apr 30, 2023 · 0 comments · Fixed by #25701
Labels
type/bug

Comments

@oyeaussie
Copy link

Description

I have repos under organization that I am accessing via API.

If I provide the correct token via AuthorizationHeaderToken or AccessToken, and make a call to [/users/{username}/repos] I get list of repos that are not marked private. This is expected behavior and is fine.

But, if I put in an incorrect token in either AutorizationHeaderToken or AccessToken and make the same call, I get an empty array in the body. Instead I am expecting some kind of error message.

With incorrect username/password combination I get the correct error message with code 401 - Error: Unauthorized :
{
"message": "user does not exist [uid: 2, name: test, keyid: 0]",
"url": "https://dev.testsrv.com/api/swagger"
}

With incorrect token, I should expect an unauthorized error.

Gitea Version

1.19.1

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

ubuntu

How are you running Gitea?

On ubuntu desktop, private installation.

Database

None
CaiCandong added a commit to CaiCandong/gitea that referenced this issue Jul 5, 2023
@CaiCandong
Fix the error message when the token is incorrect (go-gitea#24439)
53b4ad3
@CaiCandong CaiCandong mentioned this issue Jul 6, 2023
Merged
wolfogre added a commit that referenced this issue Jul 11, 2023
@CaiCandong @wolfogre @GiteaBot
Fix the error message when the token is incorrect (#25701)
491cc06 
we refactored `userIDFromToken` for the token parsing part into a new
function `parseToken`. `parseToken` returns the string `token` from
request, and a boolean `ok` representing whether the token exists or
not. So we can distinguish between token non-existence and token
inconsistency in the `verfity` function, thus solving the problem of no
proper error message when the token is inconsistent.
close #24439  
related #22119

---------

Co-authored-by: Jason Song <i@wolfogre.com>
Co-authored-by: Giteabot <teabot@gitea.io>
@GiteaBot GiteaBot mentioned this issue Jul 11, 2023
Merged
GiteaBot added a commit to GiteaBot/gitea that referenced this issue Jul 11, 2023
@CaiCandong @wolfogre @GiteaBot
Fix the error message when the token is incorrect (go-gitea#25701)
c167a99 
we refactored `userIDFromToken` for the token parsing part into a new
function `parseToken`. `parseToken` returns the string `token` from
request, and a boolean `ok` representing whether the token exists or
not. So we can distinguish between token non-existence and token
inconsistency in the `verfity` function, thus solving the problem of no
proper error message when the token is inconsistent.
close go-gitea#24439  
related go-gitea#22119

---------

Co-authored-by: Jason Song <i@wolfogre.com>
Co-authored-by: Giteabot <teabot@gitea.io>
@GiteaBot GiteaBot mentioned this issue Jul 11, 2023
Merged
GiteaBot added a commit to GiteaBot/gitea that referenced this issue Jul 11, 2023
@CaiCandong @wolfogre @GiteaBot
Fix the error message when the token is incorrect (go-gitea#25701)
807aedb 
we refactored `userIDFromToken` for the token parsing part into a new
function `parseToken`. `parseToken` returns the string `token` from
request, and a boolean `ok` representing whether the token exists or
not. So we can distinguish between token non-existence and token
inconsistency in the `verfity` function, thus solving the problem of no
proper error message when the token is inconsistent.
close go-gitea#24439  
related go-gitea#22119

---------

Co-authored-by: Jason Song <i@wolfogre.com>
Co-authored-by: Giteabot <teabot@gitea.io>
silverwind pushed a commit that referenced this issue Jul 12, 2023
@GiteaBot @CaiCandong @wolfogre
Fix the error message when the token is incorrect (#25701) (#25834)
ee87b4e 
Backport #25701 by @CaiCandong

we refactored `userIDFromToken` for the token parsing part into a new
function `parseToken`. `parseToken` returns the string `token` from
request, and a boolean `ok` representing whether the token exists or
not. So we can distinguish between token non-existence and token
inconsistency in the `verfity` function, thus solving the problem of no
proper error message when the token is inconsistent.
close #24439  
related #22119

Co-authored-by: caicandong <50507092+CaiCandong@users.noreply.github.com>
Co-authored-by: Jason Song <i@wolfogre.com>
@GiteaBot GiteaBot mentioned this issue Jul 12, 2023
Closed
silverwind pushed a commit that referenced this issue Jul 12, 2023
@GiteaBot @CaiCandong @wolfogre
Fix the error message when the token is incorrect (#25701) (#25836)
353dcc5 
Backport #25701 by @CaiCandong

we refactored `userIDFromToken` for the token parsing part into a new
function `parseToken`. `parseToken` returns the string `token` from
request, and a boolean `ok` representing whether the token exists or
not. So we can distinguish between token non-existence and token
inconsistency in the `verfity` function, thus solving the problem of no
proper error message when the token is inconsistent.
close #24439  
related #22119

Co-authored-by: caicandong <50507092+CaiCandong@users.noreply.github.com>
Co-authored-by: Jason Song <i@wolfogre.com>
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Aug 26, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
type/bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix the error message when the token is incorrect CaiCandong/gitea
1 participant
@oyeaussie