Skip to content
This repository was archived by the owner on Feb 26, 2021. It is now read-only.

Commit 87e047f

Browse files
J12934J12934
committed
Changed status code for unauthenticated requests to 403
1 parent d9a22d6 commit 87e047f

5 files changed

Lines changed: 39 additions & 14 deletions

File tree

‎scb-engine/src/main/java/io/securecodebox/engine/rest/ScanJobResource.java‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@
4444
import org.slf4j.Logger;
4545
import org.slf4j.LoggerFactory;
4646
import org.springframework.beans.factory.annotation.Autowired;
47+
import org.springframework.http.HttpStatus;
4748
import org.springframework.http.ResponseEntity;
4849
import org.springframework.security.authentication.InsufficientAuthenticationException;
4950
import org.springframework.web.bind.annotation.PathVariable;
@@ -92,6 +93,7 @@ public class ScanJobResource {
9293
@ApiResponse(code = 204, message = "No scan job available", response = void.class),
9394
@ApiResponse(code = 400, message = "Incomplete or inconsistent Request"),
9495
@ApiResponse(code = 401, message = "Unauthenticated", response = void.class),
96+
@ApiResponse(code = 403, message = "Unauthorized, the user is missing the required rights to perform this action.", response = void.class),
9597
@ApiResponse(code = 500, message = "Unknown technical error occurred.")
9698
})
9799
@RequestMapping(
@@ -118,7 +120,7 @@ public ResponseEntity<ScanConfiguration> lockJob(
118120
try{
119121
authService.checkAuthorizedFor(ResourceType.SECURITY_TEST, PermissionType.READ);
120122
}catch (InsufficientAuthenticationException e){
121-
return ResponseEntity.status(401).build();
123+
return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
122124
}
123125

124126
ExternalTaskQueryBuilder externalTaskQueryBuilder = engine.getExternalTaskService()
@@ -146,6 +148,7 @@ public ResponseEntity<ScanConfiguration> lockJob(
146148
@ApiResponse(code = 200, message = "Successful delivery of the result.", response = void.class),
147149
@ApiResponse(code = 400, message = "Incomplete or inconsistent Request"),
148150
@ApiResponse(code = 401, message = "Unauthenticated", response = void.class),
151+
@ApiResponse(code = 403, message = "Unauthorized, the user is missing the required rights to perform this action.", response = void.class),
149152
@ApiResponse(code = 404, message = "Unable to find jobId"),
150153
@ApiResponse(code = 500, message = "Unknown technical error occurred.")
151154
})
@@ -167,7 +170,7 @@ public ResponseEntity completeJob(
167170
try{
168171
authService.checkAuthorizedFor(id.toString(), ResourceType.SECURITY_TEST, PermissionType.UPDATE);
169172
}catch (InsufficientAuthenticationException e){
170-
return ResponseEntity.status(401).build();
173+
return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
171174
}
172175

173176
LOG.debug("Received scan result {}", result);
@@ -204,6 +207,7 @@ public ResponseEntity completeJob(
204207
@ApiResponse(code = 200, message = "Successful delivery of the failure.", response = void.class),
205208
@ApiResponse(code = 400, message = "Incomplete or inconsistent Request"),
206209
@ApiResponse(code = 401, message = "Unauthenticated", response = void.class),
210+
@ApiResponse(code = 403, message = "Unauthorized, the user is missing the required rights to perform this action.", response = void.class),
207211
@ApiResponse(code = 404, message = "Unable to find jobId"),
208212
@ApiResponse(code = 500, message = "Unknown technical error occurred.")
209213
}
@@ -226,7 +230,7 @@ public ResponseEntity failJob(
226230
try{
227231
authService.checkAuthorizedFor(id.toString(), ResourceType.SECURITY_TEST, PermissionType.UPDATE);
228232
}catch (InsufficientAuthenticationException e){
229-
return ResponseEntity.status(401).build();
233+
return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
230234
}
231235

232236
int retriesLeft = 0;

‎scb-engine/src/main/java/io/securecodebox/engine/rest/SecurityTestDefinitionResource.java‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
import io.swagger.annotations.ApiResponses;
2929
import io.swagger.annotations.Authorization;
3030
import org.springframework.beans.factory.annotation.Autowired;
31+
import org.springframework.http.HttpStatus;
3132
import org.springframework.http.ResponseEntity;
3233
import org.springframework.security.authentication.InsufficientAuthenticationException;
3334
import org.springframework.web.bind.annotation.RequestMapping;
@@ -63,6 +64,16 @@ public class SecurityTestDefinitionResource {
6364
response = UUID.class,
6465
responseContainer = "List"
6566
),
67+
@ApiResponse(
68+
code = 401,
69+
message = "Unauthenticated",
70+
response = void.class
71+
),
72+
@ApiResponse(
73+
code = 403,
74+
message = "Unauthorized, the user is missing the required rights to perform this action.",
75+
response = void.class
76+
),
6677
@ApiResponse(
6778
code = 500,
6879
message = "Unknown technical error occurred."
@@ -73,7 +84,7 @@ public ResponseEntity<List<String>> getSecurityTestDefinitions(){
7384
try {
7485
authService.checkAuthorizedFor(ResourceType.SECURITY_TEST_DEFINITION, PermissionType.READ);
7586
}catch (InsufficientAuthenticationException e){
76-
return ResponseEntity.status(401).build();
87+
return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
7788
}
7889

7990
List<String> securityTests = securityTestService.getAvailableSecurityTestDefinitionNames();

‎scb-engine/src/main/java/io/securecodebox/engine/rest/SecurityTestResource.java‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,11 @@ public class SecurityTestResource {
9292
message = "Unauthenticated",
9393
response = void.class
9494
),
95+
@ApiResponse(
96+
code = 403,
97+
message = "Unauthorized, the user is missing the required rights to perform this action.",
98+
response = void.class
99+
),
95100
@ApiResponse(
96101
code = 404,
97102
message = "Could not find definition for specified securityTest.",
@@ -121,7 +126,7 @@ public ResponseEntity<List<UUID>> startSecurityTests(
121126
);
122127
}
123128
} catch (InsufficientAuthenticationException e){
124-
return ResponseEntity.status(401).build();
129+
return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
125130
}
126131

127132
for (SecurityTestConfiguration securityTest : securityTests) {
@@ -169,6 +174,11 @@ public ResponseEntity<List<UUID>> startSecurityTests(
169174
message = "Unauthenticated",
170175
response = void.class
171176
),
177+
@ApiResponse(
178+
code = 403,
179+
message = "Unauthorized, the user is missing the required rights to perform this action.",
180+
response = void.class
181+
),
172182
@ApiResponse(
173183
code = 404,
174184
message = "Could not find definition for specified securityTest.",
@@ -190,7 +200,7 @@ public ResponseEntity<SecurityTest> getSecurityTest(
190200
PermissionType.READ
191201
);
192202
} catch (InsufficientAuthenticationException e){
193-
return ResponseEntity.status(401).build();
203+
return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
194204
}
195205

196206
try {

‎scb-engine/src/test/java/io/securecodebox/engine/rest/SecurityTestDefinitionsResourceTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,12 +65,12 @@ public void shouldReturnAnEmptyListIfNoProcessesAreAvailable() throws Exception
6565
}
6666

6767
@Test
68-
public void shouldReturnA401WhenTheUserIsntPermittedToAccessProcessDefinitions() throws Exception {
68+
public void shouldReturnA403WhenTheUserIsntPermittedToAccessProcessDefinitions() throws Exception {
6969
given(securityTestServiceDummy.getAvailableSecurityTestDefinitionNames()).willReturn(new LinkedList<>());
7070
willThrow(new InsufficientAuthenticationException("")).given(authService).checkAuthorizedFor(any(), any());
7171

7272
ResponseEntity<List<String>> response = classUnderTest.getSecurityTestDefinitions();
7373

74-
assertEquals(401, response.getStatusCodeValue());
74+
assertEquals(403, response.getStatusCodeValue());
7575
}
7676
}

‎scb-engine/src/test/java/io/securecodebox/engine/rest/SecurityTestResourceTest.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -98,20 +98,20 @@ public void shouldStartASecurityTestAndReturnItsUUID() throws Exception {
9898
}
9999

100100
@Test
101-
public void shouldReturnA401IfTheUserIsntAuthorizedToStartASecurityTest() throws Exception {
101+
public void shouldReturnA403IfTheUserIsntAuthorizedToStartASecurityTest() throws Exception {
102102
given(securityTestServiceDummy.startSecurityTest(any())).willReturn(UUID.fromString("47bd8786-84f2-49ed-9ca9-20ed22be532b"));
103103
willThrow(new InsufficientAuthenticationException("Foobar")).given(authService).checkAuthorizedFor(any(), any(), any());
104104
SecurityTestConfiguration secTest = new SecurityTestConfiguration();
105105
secTest.setName("this-process-is-ok");
106106

107107
ResponseEntity<List<UUID>> response = classUnderTest.startSecurityTests(Arrays.asList(secTest));
108108

109-
assertEquals(401, response.getStatusCodeValue());
109+
assertEquals(403, response.getStatusCodeValue());
110110
verify(securityTestServiceDummy, times(0)).startSecurityTest(any());
111111
}
112112

113113
@Test
114-
public void shouldReturnA401IfTheUserIsntAuthorizedToOneOfTheSecurityTestsOfThePayload() throws Exception {
114+
public void shouldReturnA403IfTheUserIsntAuthorizedToOneOfTheSecurityTestsOfThePayload() throws Exception {
115115
given(securityTestServiceDummy.startSecurityTest(any())).willReturn(UUID.fromString("47bd8786-84f2-49ed-9ca9-20ed22be532b"));
116116
willThrow(new InsufficientAuthenticationException("Foobar")).given(authService).checkAuthorizedFor(eq("this-isnt-process"), any(), any());
117117

@@ -123,7 +123,7 @@ public void shouldReturnA401IfTheUserIsntAuthorizedToOneOfTheSecurityTestsOfTheP
123123

124124
ResponseEntity<List<UUID>> response = classUnderTest.startSecurityTests(Arrays.asList(secTest, secTest2));
125125

126-
assertEquals(401, response.getStatusCodeValue());
126+
assertEquals(403, response.getStatusCodeValue());
127127
verify(securityTestServiceDummy, times(0)).startSecurityTest(any());
128128
}
129129

@@ -192,12 +192,12 @@ public void shouldReturnA500IfTheSecurityTestErrored() throws Exception {
192192
}
193193

194194
@Test
195-
public void shouldReturnA401WhenTheUserIsntPermittedToAccessTheSecurityTest() throws Exception {
195+
public void shouldReturnA403WhenTheUserIsntPermittedToAccessTheSecurityTest() throws Exception {
196196
UUID id = UUID.randomUUID();
197197
willThrow(new InsufficientAuthenticationException("Foobar")).given(authService).checkAuthorizedFor(eq(id.toString()), any(), any());
198198

199199
ResponseEntity<SecurityTest> response = classUnderTest.getSecurityTest(id);
200200

201-
assertEquals(401, response.getStatusCodeValue());
201+
assertEquals(403, response.getStatusCodeValue());
202202
}
203203
}

0 commit comments

Comments
 (0)