Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Inconsistent status code for HEAD and GET when the request is sent to public artifact. #14711

Closed
reasonerjt opened this issue Apr 21, 2021 · 1 comment
Closed

Inconsistent status code for HEAD and GET when the request is sent to public artifact. #14711

reasonerjt opened this issue Apr 21, 2021 · 1 comment
Assignees
@reasonerjt
Labels
candidate/2.3.0 kind/debt
Milestone
Sprint 111

Comments

@reasonerjt
Copy link
Contributor

Such inconsistency was introduced to workaround issue in
#11271

This approach does not follow the HTTP spec and it bites us when Harbor is running behind a CDN, some user reported seeing inconsistent status code for HEAD, possibly due to CDN caching the response header for GET requests.

We should find a way to suit our usecase and not violating the http spec at the same time.
Some mentioned that dockerhub return 401 for GET request issued to public resources. Harbor may do the same.

We should make sure the change will not break any exisitng use cases.
@reasonerjt reasonerjt self-assigned this Apr 21, 2021
@reasonerjt reasonerjt added this to the Sprint 111 milestone Apr 21, 2021
reasonerjt added a commit to reasonerjt/harbor that referenced this issue Apr 28, 2021
@reasonerjt
Return 401 for GET request to /v2 API for public artifacts.
6a379d3 
This commits make sure when the request does not carry authorization
headers, the HEAD and GET will get the same response code.  This change
should be made due to goharbor#14711

Signed-off-by: Daniel Jiang <[email protected]>
@reasonerjt reasonerjt mentioned this issue Apr 28, 2021
Merged
@reasonerjt
Copy link
Contributor Author

The minimal change in #14768 may fix the problem but this does introduce a break change in the case
client sends GET request without Authorization Header to fetch public artifact, and this should be a release note.

@sixeela sixeela mentioned this issue Jun 23, 2021
Closed
@karuppiah7890 karuppiah7890 mentioned this issue Nov 16, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@reasonerjt reasonerjt

Labels
candidate/2.3.0 kind/debt
Projects
None yet
Milestone
Sprint 111
Development

No branches or pull requests
1 participant
@reasonerjt