OAuth unauthorized errors mask the actual error text

Bug #1269648 reported by Julian Edwards
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
MAAS
Fix Released
Critical
Raphaël Badin

Bug Description

If a Nonce is re-used, the maas log has this in it:

ERROR 2014-01-15 18:18:28,633 maasserver ################################ Exception: ################################
ERROR 2014-01-15 18:18:28,633 maasserver Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/django/core/handlers/base.py", line 115, in get_response
    response = callback(request, *callback_args, **callback_kwargs)
  File "/usr/lib/python2.7/dist-packages/django/views/decorators/vary.py", line 19, in inner_func
    response = func(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/piston/resource.py", line 128, in __call__
    actor, anonymous = self.authenticate(request, rm)
  File "/usr/lib/python2.7/dist-packages/maasserver/api_support.py", line 47, in authenticate
    RestrictedResource, self).authenticate(request, rm)
  File "/usr/lib/python2.7/dist-packages/piston/resource.py", line 103, in authenticate
    if not authenticator.is_authenticated(request):
  File "/usr/lib/python2.7/dist-packages/maasserver/api_auth.py", line 57, in is_authenticated
    raise OAuthUnauthorized(error)
OAuthUnauthorized

In addition the error returned to the client does not mention it's a nonce problem. It used to do this, so this is a regression.

I realise we have nonce-cleaning code now but this can still happen and it would save support time.

Tags: regression

Related branches

tags: added: regression
Changed in maas:
status: New → Triaged
importance: Undecided → Critical
milestone: none → 14.04
Changed in maas:
assignee: nobody → Raphaël Badin (rvb)
status: Triaged → Fix Committed
Changed in maas:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.