Uploaded image for project: 'CouchDB'
  1. CouchDB
  2. COUCHDB-2534

Return forbidden error when authed user tries to access database it doesn't allowed



    • Bug
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • 2.0.0, 1.6.1
    • 2.0.0
    • Database Core
    • None


      This also cases annoying behaviour when `require_valid_user` set as `true`. Steps to reproduce:
      1. Fix admin party
      2. Create some user
      3. Create some database
      4. Setup members for those database excluding access for your user
      5. Set `require_valid_user=true`
      6. Login as the user and open up futon

      During databases list rendering Futon requests every database for the info about num of docs, db size etc. When it hits database which don't has a current user in members, CouchDB returns 401 unauthorized error, even if you are. This error comes to httpd error handler and according `require_valid_user` setting CouchDB send WWW-Authenticate header in response back to browser - this happens only for unauthorized errors. Browser sees that header and shows modal dialog to let end-user specify credentials in order to access some unnamed resource. And so happens for every database.

      If you have hundred ones and user has access only to some single one using futon/fauxton turns into nightmare.

      The error origin from couch_db:check_is_member/1 which doesn't care about if user is already auth'ed counting everyone as not in case if they are not members.




            kxepal Alexander Shorin
            kxepal Alexander Shorin
            0 Vote for this issue
            3 Start watching this issue