Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Authentication breaks, if you combine Https with different ways to authenticate #1627

@987Nabil

Description

@987Nabil

Describe the bug
Combining two apps with different auth middlewares leads to unexpected 401 returns.

To Reproduce
This happens in version 2.0.0-RC10
Let's assume we have have 3 Http instances, one without auth, one with basic auth and one with oauth. We use the zio-http defined auth middleware.
Let's start a server like this

Server.start(8080, noAuthApp ++ basicAuthApp ++ oauthApp)

The endpoints of the first apps two behave correctly, but the last one always returns 401, independent of the auth headers content. If you change the order, everything after the first authenticated Http will return 401.

You can find a reproducer here

When we build the server like this

Server.make(Server.port(8080), Server.app(noAuthApp) ++ Server.app(basicAuthApp) ++ Server.app(oauthApp))

it is even worse. Now all endpoints return always 401.

Expected behaviour
The routes of a Http are authenticated based on the middleware added to them, even when combined with others

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions