HTTP Basic Auth is providing unauthorized access to protected resources. about kitura-credentialshttp HOT 5 CLOSED

@pushkarnk thanks for the heads up. @Andrew-Lees11 is going to add a line into the Routing documentation on kitura.io about the order of execution and we're also going to start work on a middleware guide, which should go into more detail about the order of execution.

from kitura-credentialshttp.

Also confirmed by Pushkar Kulkarni. From Slack conversation:

https://swift-at-ibm.slack.com/archives/C29BLC4KB/p1560408275024600?thread_ts=1560376184.023800&cid=C29BLC4KB

pushkarnk
Yup, this is easily reproducible. And it happens in a browser window too. So, doesn't look like an OpenAPI UI issue alone. It appears like HTTPBasic auth is broken

from kitura-credentialshttp.

It may prove a good idea to add a unit test for this as well.

from kitura-credentialshttp.

It turned out that the Credentials middleware was configured after configuring the route handler.

IMO, this critical nature of the order in which middleware is configured may not be clear to new users. As @dillan asked over slack, I'm not sure if it is possible to have any safeguards against doing these in a wrong order. Any thoughts @djones6 / @ianpartridge ?

The Routing documentation does talk about an order of execution for middleware and route handlers. But may be we should document this user error as a warning there? cc @helenmasters

from kitura-credentialshttp.

Thanks @helenmasters

from kitura-credentialshttp.