[SLING-10452] adjust HTTP status code for invalid :redirect value for modifyAce/deleteAce post request

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: JCR Jackrabbit Access Manager 3.0.10
• Assignee: Eric Norman
• Reporter: Eric Norman
• Created: 02/Jun/21 17:43
• Updated: 10/Jun/21 18:22
• Resolved: 02/Jun/21 20:40

Description

When the modifyAce/deleteAce servlets receive an illegal or invalid :redirect parameter it should return a status code of 422 instead of 200 because the request was not fully successful.

Currently, the illegal :redirect parameter value is detected and a warning is logged.  The request continues to be processed without the redirect occurring.  The client has no indication that something went wrong without reviewing the server logs.

For example:

Illegal redirect 

curl -F principalId=myuser -F privilege@jcr:read=granted -F :redirect=https://sling.apache.org http://localhost:8080/test/node.modifyAce.html

 invalid redirect

curl -F principalId=myuser -F privilege@jcr:read=granted -F :redirect=https:// http://localhost:8080/test/node.modifyAce.html

Issue Links

• links to: PR #4