Skip to content

Fix 500 error for calls without JWT token to Git http

Vasilii Iakliushin requested to merge 391771_return_forbidden_error_for_internal_api into master

What does this MR do and why?

Contributes to #391771 (closed)

Sentry error: https://new-sentry.gitlab.net/organizations/gitlab/issues/6950

Problem

GitHttpController is used by Workhorse to verify Git requests for HTTP protocol. However, it's also possible to send a direct request to this controller. But the controller is protected by JWT authentication. All direct requests will raise a JWT token exception. This exception is not handled and raises a 500 error.

Solution

Add a handler for JWT decode errors and return a Forbidden (403 error).

How to set up and validate locally

curl -XPOST -H "Authorization: Bearer <YOUR_TOKEN>" http://127.0.0.1:3000/gitlab-org/gitlab-test.git/git-upload-pack

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Vasilii Iakliushin

Merge request reports