mirror of
https://github.com/nextcloud/server.git
synced 2026-03-21 10:00:33 -04:00
9b54b06de5
Currently we return a 403 (Forbidden) when the password confirmation failed - which itself seems to be inappropriate as its basically a login failing so a 401 (not authorized) is more appropriate. This is especially a problem because APIs might return 403 internally for good reason (e.g. user missing permission) but 401 would not be a problem. But as this is a breaking change so my solution to be able to distinguish API error from password confirmation error is: Add a header inside the response that marks failed password confirmation `X-NC-Auth-NotConfirmed`. Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de> |
||
|---|---|---|
| .. | ||
| PublicShare | ||
| Security | ||
| AdditionalScriptsMiddleware.php | ||
| CompressionMiddleware.php | ||
| FlowV2EphemeralSessionsMiddleware.php | ||
| MiddlewareDispatcher.php | ||
| MiddlewareUtils.php | ||
| NotModifiedMiddleware.php | ||
| OCSMiddleware.php | ||
| SessionMiddleware.php | ||