-
-
Notifications
You must be signed in to change notification settings - Fork 466
Description
Describe the bug
Combining two apps with different auth middlewares leads to unexpected 401 returns.
To Reproduce
This happens in version 2.0.0-RC10
Let's assume we have have 3 Http instances, one without auth, one with basic auth and one with oauth. We use the zio-http defined auth middleware.
Let's start a server like this
Server.start(8080, noAuthApp ++ basicAuthApp ++ oauthApp)The endpoints of the first apps two behave correctly, but the last one always returns 401, independent of the auth headers content. If you change the order, everything after the first authenticated Http will return 401.
You can find a reproducer here
When we build the server like this
Server.make(Server.port(8080), Server.app(noAuthApp) ++ Server.app(basicAuthApp) ++ Server.app(oauthApp))it is even worse. Now all endpoints return always 401.
Expected behaviour
The routes of a Http are authenticated based on the middleware added to them, even when combined with others