Skip to content

Go-get: return 404 error code when personal token is invalid

What does this MR do and why?

Contributes to #501082 (closed)

Problem

When user provides an invalid personal access token with credentials and authentication by password is not supported, then GitLab responds with 401 error code instead of an expected code 404.

Solution

Return 404 error code to make responses for invalid credentials case consistent.

References

Please include cross links to any resources that are relevant to this MR This will give reviewers and future readers helpful context to give an efficient review of the changes introduced.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Before

curl -I -n "http://gdk.test:3000/public_group/private-project?go-get=1"
HTTP/1.1 401 Unauthorized

After

curl -I -n "http://gdk.test:3000/public_group/private-project?go-get=1"
HTTP/1.1 404 Not Found

How to set up and validate locally

  1. Create a private project
  2. Create a .netrc file in your user folder with invalid credentials
echo "default login root password glpat-wrong" > ~/.netrc
  1. Restart GDK
  2. curl -I -n "http://gdk.test:3000/gitlab-org/private_project?go-get=1" (replace project path with your private project)
  3. You should receive 404 response
  4. Disable checkbox Allow password authentication for Git over HTTP(S) in Admin -> Settings -> General -> Sign-in restrictions
  5. Restart GDK
  6. curl -I -n "http://gdk.test:3000/gitlab-org/private_project?go-get=1" (replace project path with your private project)
  7. You should still receive 404 response (on master branch it will be 401 instead)
Edited by Vasilii Iakliushin

Merge request reports

Loading