Uploaded image for project: 'CouchDB'
  1. CouchDB
  2. COUCHDB-2534

Return forbidden error when authed user tries to access database it doesn't allowed

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 2.0.0, 1.6.1
    • Fix Version/s: 2.0.0
    • Component/s: Database Core
    • Labels:
      None

      Description

      This also cases annoying behaviour when `require_valid_user` set as `true`. Steps to reproduce:
      1. Fix admin party
      2. Create some user
      3. Create some database
      4. Setup members for those database excluding access for your user
      5. Set `require_valid_user=true`
      6. Login as the user and open up futon

      During databases list rendering Futon requests every database for the info about num of docs, db size etc. When it hits database which don't has a current user in members, CouchDB returns 401 unauthorized error, even if you are. This error comes to httpd error handler and according `require_valid_user` setting CouchDB send WWW-Authenticate header in response back to browser - this happens only for unauthorized errors. Browser sees that header and shows modal dialog to let end-user specify credentials in order to access some unnamed resource. And so happens for every database.

      If you have hundred ones and user has access only to some single one using futon/fauxton turns into nightmare.

      The error origin from couch_db:check_is_member/1 which doesn't care about if user is already auth'ed counting everyone as not in case if they are not members.

        Attachments

          Activity

            People

            • Assignee:
              kxepal Alexander Shorin
              Reporter:
              kxepal Alexander Shorin
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: