fix: return 400

beclab · Apr 8, 2024 · e6bb2f7 · e6bb2f7
1 parent 378b74e
commit e6bb2f7
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 2 deletions.
diff --git a/internal/handlers/handler_authz_impl_extauthz.go b/internal/handlers/handler_authz_impl_extauthz.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/valyala/fasthttp"
 
+	"github.com/authelia/authelia/v4/internal/authentication"
 	"github.com/authelia/authelia/v4/internal/authorization"
 	"github.com/authelia/authelia/v4/internal/middlewares"
 )
@@ -57,7 +58,11 @@ func handleAuthzUnauthorizedExtAuthz(ctx *middlewares.AutheliaCtx, authn *Authn,
 	switch string(mode) {
 	case NonRedirectMode:
 		ctx.Logger.Infof("[ext_authz] Access to %s (method %s) is not authorized to user %s, responding with status code %d", authn.Object.URL.String(), authn.Method, authn.Username, statusCode)
-		ctx.ReplyUnauthorized()
+		if authn.Level == authentication.NotAuthenticated {
+			ctx.ReplyBadRequest()
+		} else {
+			ctx.ReplyUnauthorized()
+		}
 	default:
 		ctx.SpecialRedirect(redirectionURL.String(), statusCode)
 	}

diff --git a/internal/handlers/handler_authz_impl_legacy.go b/internal/handlers/handler_authz_impl_legacy.go
@@ -114,6 +114,10 @@ func handleAuthzUnauthorizedLegacy(ctx *middlewares.AutheliaCtx, authn *Authn, r
 		}
 	} else {
 		ctx.Logger.Infof("[legacy] Access to %s (method %s) is not authorized to user %s, responding with status code %d", authn.Object.URL.String(), authn.Method, authn.Username, statusCode)
-		ctx.ReplyUnauthorized()
+		if authn.Level == authentication.NotAuthenticated {
+			ctx.ReplyBadRequest()
+		} else {
+			ctx.ReplyUnauthorized()
+		}
 	}
 }