If the Jakarta Authentication fails with an exception, set a 500 status

Depending on what fails where, the status may not be set or may be set incorrectly.
apache · Sep 19, 2024 · 6d097a6 · 6d097a6
1 parent 8339eb7
commit 6d097a6
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/java/org/apache/catalina/authenticator/AuthenticatorBase.java b/java/org/apache/catalina/authenticator/AuthenticatorBase.java
@@ -803,6 +803,8 @@ private boolean authenticateJaspic(Request request, Response response, JaspicSta
             authStatus = state.serverAuthContext.validateRequest(state.messageInfo, client, null);
         } catch (AuthException e) {
             log.debug(sm.getString("authenticator.loginFail"), e);
+            // Need to explicitly set the return code as the ServerAuthContext may not have done.
+            response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
             return false;
         }
 

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
@@ -117,6 +117,11 @@
         creates one <code>GenericPrincipal</code> in the <code>Subject</code>.
         (markt)
       </fix>
+      <fix>
+        If the Jakarta Authentication process fails with an Exception,
+        explicitly set the HTTP response status to 500 as the
+        <code>ServerAuthContext</code> may not have set it. (markt)
+      </fix>
     </changelog>
   </subsection>
 </section>