Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 934587a

Browse files
XVincentXXVincentX
authoredSep 17, 2019
fix: Prism has not enough informations to return a 403 in any case (stoplightio#625)
* fix: 403 is not a thing * docs: changelog * docs: changelog * test: fix
1 parent b2b2df0 commit 934587a

10 files changed

+33
-45
lines changed
 

‎CHANGELOG.md

+16-15
Original file line numberDiff line numberDiff line change
@@ -10,36 +10,37 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
1010

1111
## Fixed
1212

13-
- Prism is now giving precedence to `application/json` instead of using it as a "fallback" serializer, fixing some conditions where it wouldn't get triggered correctly. #604
14-
- Prism is now taking in consideration the `required` properties for combined schemas (`oneOf, allOf`). This is coming through an update to the Json Schema Faker Library #623
13+
- Prism is now giving precedence to `application/json` instead of using it as a "fallback" serializer, fixing some conditions where it wouldn't get triggered correctly. [#604](https://github.com/stoplightio/prism/pulls/604)
14+
- Prism is now taking in consideration the `required` properties for combined schemas (`oneOf, allOf`). This is coming through an update to the Json Schema Faker Library [#623](https://github.com/stoplightio/prism/pulls/623)
15+
- Prism will never have enough information to return a `403` status code; all these occurences have been now replaced with a `401` status code which is more appropriate [#625](https://github.com/stoplightio/prism/pulls/625)
1516

1617
# 3.1.0 (2019-09-03)
1718

1819
## Added
1920

20-
- Prism is now able to validate the security specification of the loaded document #484
21+
- Prism is now able to validate the security specification of the loaded document [#484](https://github.com/stoplightio/prism/pulls/484)
2122

2223
## Fixed
2324

24-
- Prism is not crashing anymore when referencing the same model multiple times in the specification document #552
25-
- Prism will now correctly use the `example` keyword for a Schema Object in OpenAPI 3.0 documents #560
26-
- Prism won't return 406 when users request a `text/plain` response whose content is a primitive (string, number) #560
27-
- Prism's router is now able to correctly handle a path ending with a parameter, such as `/test.{format}`, while it would previously not match with anything. #561
28-
- Prism is correctly handling the `allowEmptyValue` property in OAS2 documents #569
29-
- Prism is correctly handling the `csv` collection format argument property in OAS2 documents #577
30-
- Prism is correctly returning the response when the request has `*/*` as Accept header #578
31-
- Prism is correctly returning a single root node with the payload for XML data #578
25+
- Prism is not crashing anymore when referencing the same model multiple times in the specification document [#552](https://github.com/stoplightio/prism/pulls/552)
26+
- Prism will now correctly use the `example` keyword for a Schema Object in OpenAPI 3.0 documents [#560](https://github.com/stoplightio/prism/pulls/560)
27+
- Prism won't return 406 when users request a `text/plain` response whose content is a primitive (string, number) [#560](https://github.com/stoplightio/prism/pulls/560)
28+
- Prism's router is now able to correctly handle a path ending with a parameter, such as `/test.{format}`, while it would previously not match with anything. [#561](https://github.com/stoplightio/prism/pulls/561)
29+
- Prism is correctly handling the `allowEmptyValue` property in OAS2 documents [#569](https://github.com/stoplightio/prism/pulls/569)
30+
- Prism is correctly handling the `csv` collection format argument property in OAS2 documents [#577](https://github.com/stoplightio/prism/pulls/577)
31+
- Prism is correctly returning the response when the request has `*/*` as Accept header [#578](https://github.com/stoplightio/prism/pulls/578)
32+
- Prism is correctly returning a single root node with the payload for XML data [#578](https://github.com/stoplightio/prism/pulls/578)
3233

3334
# 3.0.4 (2019-08-20)
3435

3536
## Added
3637

37-
- Prism is now returning CORS headers by default and responding to all the preflights requests. You can disable this behaviour by running Prism with the `--cors` flag set to false #525
38+
- Prism is now returning CORS headers by default and responding to all the preflights requests. You can disable this behaviour by running Prism with the `--cors` flag set to false [#525](https://github.com/stoplightio/prism/pulls/525)
3839

3940
## Fixed
40-
- Prism now respects the `nullable` value for OpenAPI 3.x documents when generating examples #506
41-
- Prism now loads correctly OpenAPI 3.x documents with `encodings` with non specified `style` property #507
42-
- Prism got rid of some big internal dependencies that now aren't required anymore, making it faster and lighter. #490
41+
- Prism now respects the `nullable` value for OpenAPI 3.x documents when generating examples [#506](https://github.com/stoplightio/prism/pulls/506)
42+
- Prism now loads correctly OpenAPI 3.x documents with `encodings` with non specified `style` property [#507](https://github.com/stoplightio/prism/pulls/507)
43+
- Prism got rid of some big internal dependencies that now aren't required anymore, making it faster and lighter. [#490](https://github.com/stoplightio/prism/pulls/490)
4344
- Prism now correctly validates OAS2 `application/x-www-urlencoded` (form data) params (#483)
4445

4546
# 3.0.3 (2019-07-25)

‎docs/guides/errors.md

-7
Original file line numberDiff line numberDiff line change
@@ -172,13 +172,6 @@ This class of errors is returned when the current request is not satisfying the
172172

173173
---
174174

175-
### FORBIDDEN
176-
**Message: Invalid credentials used**
177-
**Returned Status Code: `403`**
178-
**Explanation:** This error occurs when the current request is using the correct security scheme, but its content was invalid. This might be an error in the decoding process (such as a not valid base64 payload)
179-
180-
---
181-
182175
## Negotiation errors
183176

184177
This class of errors is returned when anything goes wrong in between your **valid** request and returning a suitable response

‎packages/core/src/utils/__tests__/security.spec.ts

+4-4
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ describe('validateSecurity', () => {
2828
it('fails with an invalid credentials error', () => {
2929
assertSome(validateSecurity({ headers: { authorization: 'Basic abc123' } }, { security: securityScheme }), res =>
3030
expect(res).toStrictEqual({
31-
code: 403,
32-
message: 'Invalid credentials used',
31+
code: 401,
32+
message: 'Invalid security scheme used',
3333
severity: DiagnosticSeverity.Error,
3434
}),
3535
);
@@ -64,8 +64,8 @@ describe('validateSecurity', () => {
6464
validateSecurity({ headers: { authorization: 'Digest username=""' } }, { security: securityScheme }),
6565
res =>
6666
expect(res).toStrictEqual({
67-
code: 403,
68-
message: 'Invalid credentials used',
67+
code: 401,
68+
message: 'Invalid security scheme used',
6969
severity: DiagnosticSeverity.Error,
7070
}),
7171
);

‎packages/core/src/utils/security/handlers/utils.ts

+2-2
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ import { Either, left, right } from 'fp-ts/lib/Either';
33
import { IPrismDiagnostic } from '../../../types';
44

55
const forbiddenErr: IPrismDiagnostic = {
6-
code: 403,
7-
message: 'Invalid credentials used',
6+
code: 401,
7+
message: 'Invalid security scheme used',
88
severity: DiagnosticSeverity.Error,
99
};
1010

‎packages/http/src/mocker/HttpMocker.ts

+3-3
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ import {
1818
ProblemJsonError,
1919
} from '../types';
2020
import withLogger from '../withLogger';
21-
import { FORBIDDEN, UNAUTHORIZED, UNPROCESSABLE_ENTITY } from './errors';
21+
import { UNAUTHORIZED, UNPROCESSABLE_ENTITY } from './errors';
2222
import { generate, generateStatic } from './generator/JSONSchema';
2323
import helpers from './negotiator/NegotiatorHelpers';
2424
import { IHttpNegotiationResult } from './negotiator/types';
@@ -61,11 +61,11 @@ function handleInputValidation(input: IPrismInput<IHttpRequest>, resource: IHttp
6161
pipe(
6262
helpers.negotiateOptionsForInvalidRequest(resource.responses),
6363
mapLeft(() => {
64-
const securityValidation = input.validations.input.find(i => i.code === 401 || i.code === 403);
64+
const securityValidation = input.validations.input.find(valiation => valiation.code === 401);
6565

6666
return securityValidation
6767
? ProblemJsonError.fromTemplate(
68-
securityValidation.code === 401 ? UNAUTHORIZED : FORBIDDEN,
68+
UNAUTHORIZED,
6969
'',
7070
securityValidation.tags && securityValidation.tags.length
7171
? {

‎packages/http/src/mocker/errors.ts

-6
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,3 @@ export const UNAUTHORIZED: Omit<ProblemJson, 'detail'> = {
2323
title: 'Invalid security scheme used',
2424
status: 401,
2525
};
26-
27-
export const FORBIDDEN: Omit<ProblemJson, 'detail'> = {
28-
type: 'FORBIDDEN',
29-
title: 'Invalid credentials used',
30-
status: 403,
31-
};

‎test-harness/specs/security-scheme-validation-AC-5.oas2.txt

+2-2
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,6 @@ mock -p 4010
2626
====command====
2727
curl -i http://localhost:4010/todos -H "Authorization: Basic abc123"
2828
====expect====
29-
HTTP/1.1 403 Forbidden
29+
HTTP/1.1 401 Unauthorized
3030

31-
{"type":"https://stoplight.io/prism/errors#FORBIDDEN","title":"Invalid credentials used","status":403,"detail":""}
31+
{"type":"https://stoplight.io/prism/errors#UNAUTHORIZED","title":"Invalid security scheme used","status":401,"detail":""}

‎test-harness/specs/security-scheme-validation-AC-5.oas3.txt

+2-2
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,6 @@ mock -p 4010
2929
====command====
3030
curl -i http://localhost:4010/todos -H "Authorization: Basic abc123"
3131
====expect====
32-
HTTP/1.1 403 Forbidden
32+
HTTP/1.1 401 Unauthorized
3333

34-
{"type":"https://stoplight.io/prism/errors#FORBIDDEN","title":"Invalid credentials used","status":403,"detail":""}
34+
{"type":"https://stoplight.io/prism/errors#UNAUTHORIZED","title":"Invalid security scheme used","status":401,"detail":""}

‎test-harness/specs/security-scheme-validation-AC-6.oas2.txt

+2-2
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,6 @@ mock -p 4010
3030
====command====
3131
curl -i http://localhost:4010/todos -H "Authorization: Basic abc123"
3232
====expect====
33-
HTTP/1.1 403 Forbidden
33+
HTTP/1.1 401 Unauthorized
3434

35-
{"type":"https://stoplight.io/prism/errors#FORBIDDEN","title":"Invalid credentials used","status":403,"detail":""}
35+
{"type":"https://stoplight.io/prism/errors#UNAUTHORIZED","title":"Invalid security scheme used","status":401,"detail":""}

‎test-harness/specs/security-scheme-validation-AC-6.oas3.txt

+2-2
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,6 @@ mock -p 4010
3131
====command====
3232
curl -i http://localhost:4010/todos -H "Authorization: Basic abc123"
3333
====expect====
34-
HTTP/1.1 403 Forbidden
34+
HTTP/1.1 401 Unauthorized
3535

36-
{"type":"https://stoplight.io/prism/errors#FORBIDDEN","title":"Invalid credentials used","status":403,"detail":""}
36+
{"type":"https://stoplight.io/prism/errors#UNAUTHORIZED","title":"Invalid security scheme used","status":401,"detail":""}

0 commit comments

Comments
 (0)
Failed to load comments.