Zaki/Password-Manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(http): return 401 (not 500) on expired/rejected session

Browse Source 
Authenticate/RequireCSRF write a 401 then raise ESessionRejected; when it
reached the dispatcher catch-all, the generic `on E: Exception` overwrote it
with a 500. Added `on ESessionRejected do Exit` before the generic clause in
both dispatchers (GET + Other) — one place, covers every handler whether or
not it wraps Authenticate. Root cause, not per-handler patch.

ponytail: runtime check only (expired token → 401) — no Delphi unit harness.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
r-zakarya
2026-07-09 21:42:08 +01:00
parent a980af1e94
commit b023eab1f4
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CODE_AUDIT.md
+1 -1
View File
@@ -200,7 +200,7 @@ entries), problématique au-delà.
**Recommandation** : batcher les déchiffrements (Promise.all par lots), **Recommandation** : batcher les déchiffrements (Promise.all par lots),
et si besoin paginer côté serveur pour la vue grille. et si besoin paginer côté serveur pour la vue grille.
### 2.5 🟡 500 au lieu de 401 sur session expirée ### 2.5 ✅ 500 au lieu de 401 sur session expirée — corrigé (2026-07-09)
`Authenticate` écrit 401 puis `raise ESessionRejected` → le `try/except` `Authenticate` écrit 401 puis `raise ESessionRejected` → le `try/except`
global de `PM.HTTPServer` réécrit un **500**. Pré-existant, tous les global de `PM.HTTPServer` réécrit un **500**. Pré-existant, tous les
delphi-backend/Source/PM.HTTPServer.pas
+5 -1
View File
@@ -15,7 +15,7 @@ uses
Winapi.Windows, Winapi.Windows,
IdHTTPServer, IdContext, IdCustomHTTPServer, IdSocketHandle, IdTCPConnection, IdHTTPServer, IdContext, IdCustomHTTPServer, IdSocketHandle, IdTCPConnection,
PM.Router, PM.JSON, PM.Database, PM.StaticFiles, PM.EmbeddedAssets, PM.Router, PM.JSON, PM.Database, PM.StaticFiles, PM.EmbeddedAssets,
PM.Crypto, PM.ProcessLockdown; PM.Crypto, PM.ProcessLockdown, PM.Session;
type type
TLogProc = reference to procedure(const AMsg: string); TLogProc = reference to procedure(const AMsg: string);
@@ -284,6 +284,9 @@ begin
if Assigned(StaticServer) and StaticServer.TryServe(ARequest, AResponse) then Exit; if Assigned(StaticServer) and StaticServer.TryServe(ARequest, AResponse) then Exit;
TJSONHelper.SendError(AResponse, 404, 'Not found'); TJSONHelper.SendError(AResponse, 404, 'Not found');
except except
// Authenticate/RequireCSRF already wrote the 401 — don't overwrite it
// with a 500. Any handler that doesn't wrap Authenticate lands here.
on ESessionRejected do Exit;
on E: Exception do on E: Exception do
begin begin
Log('ERROR ' + ARequest.Command + ' ' + ARequest.Document + ' : ' + E.Message); Log('ERROR ' + ARequest.Command + ' ' + ARequest.Document + ' : ' + E.Message);
@@ -308,6 +311,7 @@ begin
if not Router.DispatchRequest(ARequest, AResponse) then if not Router.DispatchRequest(ARequest, AResponse) then
TJSONHelper.SendError(AResponse, 404, 'Not found'); TJSONHelper.SendError(AResponse, 404, 'Not found');
except except
on ESessionRejected do Exit; // 401 already sent — keep it, don't 500
on E: Exception do on E: Exception do
begin begin
Log('ERROR ' + ARequest.Command + ' ' + ARequest.Document + ' : ' + E.Message); Log('ERROR ' + ARequest.Command + ' ' + ARequest.Document + ' : ' + E.Message);