Repository navigation
Deny status 401 #11
Description
How to return 401s to the client on auth failure.
frontend http
# *snip*
http-request deny if ! { var(txn.auth_response_successful) -m bool }
will return 403.
we can use
frontend http
# *snip*
http-request auth if ! { var(txn.auth_response_successful) -m bool }
But it'll return 401 with basic auth instead of bearer token. Do you have any workaround for this?
Activity
TimWolla commentedon Nov 22, 2019
lastlegion commentedon Nov 22, 2019
Hi @TimWolla, thanks for responding. For
deny_statusthe list of permitted status codes is limited to those that can be overridden by the "errorfile" directive. 401 is not in the "errorfile" directive. https://cbonte.github.io/haproxy-dconv/1.7/configuration.htmlTimWolla commentedon Nov 22, 2019
@lastlegion Yes, I'm aware of that limitation, but I incorrectly assumed that 401 would be on that list.
As you need to have Lua anyway in order to run this script I guess the best solution for your use case is to add a Lua "service" to generate the correct response. An example can be found on this blog post: https://www.haproxy.com/de/blog/5-ways-to-extend-haproxy-with-lua/
lastlegion commentedon Nov 24, 2019
Hi @TimWolla, thanks for the suggestion! That looks like it'll work. Great job with the library.