Repository: gisaia/ARLAS-server (language: python)

Issue:
Public uri sends 403 if we provide an invalid token
We need to check public URI in authorization module if a token is provided


Discussion / hints:

Fix patch:
diff --git a/arlas-admin/src/main/java/io/arlas/server/admin/auth/AuthorizationFilter.java b/arlas-admin/src/main/java/io/arlas/server/admin/auth/AuthorizationFilter.java
index a3840846e..17d7b046c 100644
--- a/arlas-admin/src/main/java/io/arlas/server/admin/auth/AuthorizationFilter.java
+++ b/arlas-admin/src/main/java/io/arlas/server/admin/auth/AuthorizationFilter.java
@@ -64,13 +64,13 @@ public AuthorizationFilter(ArlasAuthConfiguration conf) throws Exception {
     public void filter(ContainerRequestContext ctx) {
         Transaction transaction = ElasticApm.currentTransaction();
 
-        String header = ctx.getHeaderString(HttpHeaders.AUTHORIZATION);
-        if (header == null || !header.toLowerCase().startsWith("bearer ")) {
-            // Check if endpoint is public and if the verb is authorize
+        // Check if endpoint is public and if the verb is authorized
             if (ctx.getUriInfo().getPath().concat(":").concat(ctx.getMethod()).matches(authConf.getPublicRegex()) || ctx.getMethod() == "OPTIONS") {
                 return;
             }
-        } else {
+
+        String header = ctx.getHeaderString(HttpHeaders.AUTHORIZATION);
+        if (header != null && header.toLowerCase().startsWith("bearer ")) {
             // if a token is provided
             // if method !== options
             // verify token and pass it


Test patch:
diff --git a/arlas-tests/src/test/java/io/arlas/server/tests/auth/AuthServiceIT.java b/arlas-tests/src/test/java/io/arlas/server/tests/auth/AuthServiceIT.java
index c35a526fd..7e0b2ae5d 100644
--- a/arlas-tests/src/test/java/io/arlas/server/tests/auth/AuthServiceIT.java
+++ b/arlas-tests/src/test/java/io/arlas/server/tests/auth/AuthServiceIT.java
@@ -39,11 +39,25 @@ public class AuthServiceIT extends AbstractTestContext {
     private String token = "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FWXhNVEF3TTBORk9URXlSVVpDTlRRek0wVXhOVU0xUlVWQlF6TTNNVFpFT0VZNFJEWTBPUSJ9.eyJodHRwOi8vYXJsYXMuaW8vcGVybWlzc2lvbnMiOlsicnVsZTpjb2xsZWN0aW9uczpHRVQ6MTAwIiwicnVsZTpleHBsb3JlL19saXN0OkdFVDoyMDAiLCJ2YXJpYWJsZTpvcmdhbmlzYXRpb246YXh4ZXMiLCJoZWFkZXI6UGFydGl0aW9uLUZpbHRlcjoke29yZ2FuaXNhdGlvbn0iLCJydWxlOmV4cGxvcmUvJHtvcmdhbmlzYXRpb259L19zZWFyY2g6R0VUOjMwMCJdLCJodHRwOi8vYXJsYXMuaW8vZ3JvdXBzIjpbIlRlc3QgR3JvdXAiXSwiaHR0cDovL2FybGFzLmlvL3JvbGVzIjpbInJvbGU6YXh4ZXNFeHBsb3JlciJdLCJodHRwOi8vYXJsYXMuaW8vZmlsdGVyIjoiY291bnRyeTplcTpGUiIsIm5pY2tuYW1lIjoiYWxhaW4uYm9kaWd1ZWwiLCJuYW1lIjoiYWxhaW4uYm9kaWd1ZWxAZ21haWwuY29tIiwicGljdHVyZSI6Imh0dHBzOi8vcy5ncmF2YXRhci5jb20vYXZhdGFyLzk2YTkzMDZjOTg4NjkyYzNjNDJkZmUxNzkyNTU1MGU4P3M9NDgwJnI9cGcmZD1odHRwcyUzQSUyRiUyRmNkbi5hdXRoMC5jb20lMkZhdmF0YXJzJTJGYWwucG5nIiwidXBkYXRlZF9hdCI6IjIwMTktMDktMDNUMDk6Mjc6NDcuMjY1WiIsImlzcyI6Imh0dHBzOi8vdGVzdGFybGFzLmV1LmF1dGgwLmNvbS8iLCJzdWIiOiJhdXRoMHw1ZDNlZGY5NGJiNDhiNDBlYzcwMTZmNGEiLCJhdWQiOiJBek5nZ2t4SGhTWlRFcEI0VWhIcDVuUGN0UWJWNGNVSCIsImlhdCI6MTU2NzUwMjg2OSwiZXhwIjoxODgyODYyODY5fQ.kVabMa-OzwBy9M9PMCKx3U9WMajKYTVYWlWsck17SoZje90lkEObhGHY_XgPcLl7dhOO2DHc1sc1y_e7VnAFielz5jr50stLm04ublI6LKk_n2AoagpLnc-NPoEjPAVIxvODdxSx6TpVIOhe63zO7e6KcQOrR2MN_1vm5f7kdaSBIynpmR7E-gyr92cbZkLcQD5wGATFau17zmczudDEjcxfhLLTpJh_5-rvYHwESDZmnrfXtGPoK0R_G3DWwwLVUB15mQAMt17m4mkUwQ3qD0E7zmXoGzXhOAHq4XY3X7CVJjlsqVnjQvfvme-1vPJP4Fu7hOb8WF_0klc77OBiUA";
 
     @Test
-    public void testAccessPublicResource() throws Exception {
+    public void testAccessPublicResourceWithoutAuthHeader() throws Exception {
         when().get(arlasPath + "swagger")
                 .then().statusCode(200);
     }
 
+    @Test
+    public void testAccessPublicResourceWithInvalidAuthHeader() throws Exception {
+        given().header(HttpHeaders.AUTHORIZATION, "foo")
+                .when().get(arlasPath + "swagger")
+                .then().statusCode(200);
+    }
+
+    @Test
+    public void testAccessPublicResourceWithValidAuthHeader() throws Exception {
+        given().header(HttpHeaders.AUTHORIZATION, token)
+                .when().get(arlasPath + "swagger")
+                .then().statusCode(200);
+    }
+
     @Test
     public void testAccessProtectedResourceWithoutAuthHeader() throws Exception {
         when().get(getUrlPath(""))