Uploaded image for project: 'Nuxeo Platform'
  1. Nuxeo Platform
  2. NXP-24792

Don't challenge clients with basic auth on api calls with invalid credentials

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Critical
    • Resolution: Duplicate
    • Affects Version/s: 9.10, 10.1
    • Fix Version/s: None
    • Component/s: Rest API

      Description

      The server responds with 401 and includes the header WWW-Authenticate: Basic realm="Nuxeo Automation"

      When using webui and the session timeouts, this triggers the browser basic auth dialog which makes no sense if another authentication system is used (like SAML)

      The same issue can also be observed in the new Adobe CC connector.

        Attachments

          Issue Links

          duplicates

          Bug - A problem which impairs or prevents the functions of the product. NXP-26843 Fix security not restricted enough when logging anew with a restricted user

          • Critical - Crashes, loss of data, severe memory leak.
          • Resolved
          is related to

          Bug - A problem which impairs or prevents the functions of the product. NXP-26208 Handle expired session in WebUI properly

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Resolved
          is required by

          Bug - A problem which impairs or prevents the functions of the product. NXP-25021 Handle expired session in WebUI

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Resolved

          Improvement - An improvement or enhancement to an existing feature or task. NXP-24864 Handle the HTTP 401 Unauthorized error gracefully

          • Major - Major loss of function.
          • Resolved

            Activity

              People

              • Votes:
                6 Vote for this issue
                Watchers:
                5 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: