From a6b7cfe967674267bafb5ed28152a8ad42992cc1 Mon Sep 17 00:00:00 2001 From: Maxim Dounin Date: Fri, 18 Oct 2013 18:13:49 +0400 Subject: Fixed "satisfy any" if 403 is returned after 401 (ticket #285). The 403 (Forbidden) should not overwrite 401 (Unauthorized) as the latter should be returned with the WWW-Authenticate header to request authentication by a client. The problem could be triggered with 3rd party modules and the "deny" directive, or with auth_basic and auth_request which returns 403 (in 1.5.4+). Patch by Jan Marc Hoffmann. --- src/http/ngx_http_core_module.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'src/http/ngx_http_core_module.c') diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c index f8c695645..d2e29136d 100644 --- a/src/http/ngx_http_core_module.c +++ b/src/http/ngx_http_core_module.c @@ -1144,7 +1144,9 @@ ngx_http_core_access_phase(ngx_http_request_t *r, ngx_http_phase_handler_t *ph) } if (rc == NGX_HTTP_FORBIDDEN || rc == NGX_HTTP_UNAUTHORIZED) { - r->access_code = rc; + if (r->access_code != NGX_HTTP_UNAUTHORIZED) { + r->access_code = rc; + } r->phase_handler++; return NGX_AGAIN; -- cgit