Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Date: Sun, 13 Feb 2011 12:22:57 +0000 (UTC)
From: "Robert Newson (JIRA)" <jira@apache.org>
To: dev@couchdb.apache.org
Message-ID: 
 <326486116.13632.1297599777470.JavaMail.tomcat@hel.zones.apache.org>
Subject: [jira] Created: (COUCHDB-1066) cookie_authentication_handler does
 not throw if cookie is invalid or has expired
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

cookie_authentication_handler does not throw if cookie is invalid or has expired
--------------------------------------------------------------------------------

                 Key: COUCHDB-1066
                 URL: https://issues.apache.org/jira/browse/COUCHDB-1066
             Project: CouchDB
          Issue Type: Bug
    Affects Versions: 1.0.2
            Reporter: Robert Newson
            Assignee: Robert Newson
            Priority: Critical


cookie_authentication_handler does not throw if the cookie is invalid or has expired, instead it delegates to the next handler.

This leads to ugly results like getting a response from /_session but with no userCtx filled in.

cookie_authentication_handler should throw if, and only if, there's an AuthSession cookie that is expired or invalid. We shouldn't attempt to try other auth schemes. If there is no such cookie, then we delegate.

-- 
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira