Go-get: return 404 error code when personal token is invalid
What does this MR do and why?
Contributes to #501082 (closed)
Problem
When user provides an invalid personal access token with credentials and authentication by password is not supported, then GitLab responds with 401 error code instead of an expected code 404.
Solution
Return 404 error code to make responses for invalid credentials case consistent.
References
Please include cross links to any resources that are relevant to this MR This will give reviewers and future readers helpful context to give an efficient review of the changes introduced.
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Screenshots or screen recordings
Before
curl -I -n "http://gdk.test:3000/public_group/private-project?go-get=1"
HTTP/1.1 401 Unauthorized
After
curl -I -n "http://gdk.test:3000/public_group/private-project?go-get=1"
HTTP/1.1 404 Not Found
How to set up and validate locally
- Create a private project
- Create a
.netrcfile in your user folder with invalid credentials
echo "default login root password glpat-wrong" > ~/.netrc
- Restart GDK
-
curl -I -n "http://gdk.test:3000/gitlab-org/private_project?go-get=1"(replace project path with your private project) - You should receive 404 response
- Disable checkbox
Allow password authentication for Git over HTTP(S)in Admin -> Settings -> General -> Sign-in restrictions - Restart GDK
-
curl -I -n "http://gdk.test:3000/gitlab-org/private_project?go-get=1"(replace project path with your private project) - You should still receive 404 response (on
masterbranch it will be 401 instead)
Edited by Vasilii Iakliushin