Only remove telltale response headers in case of 401 or 403#95189
Conversation
|
Pinging @elastic/es-security (Team:Security) |
|
@jakelandis I realised I haven't done too great of a job explaining this live, so I'll try it a second time below: Right now, authN failure responses are generated in the In order to achieve that, I moved most of the special code in the Makes it that all Makes it that |
| } | ||
|
|
||
| }); | ||
| channel.sendResponse(new RestResponse(channel, e)); |
There was a problem hiding this comment.
This here is the goal: new RestResponse(channel, e) is how responses are generated from exceptions everywhere else in the codebase.
This is important because authN failure exceptions will be signaled like exceptions for invalid/malformed requests.
|
Thank you for the ⚡ review Jake! |
…95189) This ensures that Warning and X-elastic-product response headers are only removed in case of 401 or 403 HTTP error response codes. Previously, the response headers were also removed in non 401 and 403 conditions, in case of esoteric errors during authN, but this behavior displaced the response-filtering logic to an uncomfortable code site from a reusability pov.
This ensures that
WarningandX-elastic-productresponseheaders are only removed in case of 401 or 403 HTTP error
response codes.
Previously, the response headers were also removed in non
401 and 403 conditions, in case of esoteric errors during authN,
but this behavior displaced the response-filtering logic to
an uncomfortable code site from a reusability pov.