Calls to CouchDB's _session always return 200

user_726766 0
Viewed 217

Is it right that calls to the CouchDB _session endpoint always seem to return a 200 HTTP status code, even if the cookie I'm passing is absent or wrong?

Passing a wrong cookie or no cookie in my GET request headers always seems to return:

{
  "ok": true,
  "userCtx": {
    "name": null,
    "roles": []
  },
  "info": {
    "authentication_db": "_users",
    "authentication_handlers": [
      "cookie",
      "default"
    ]
  }
}

When passing the correct cookie, I receive a slightly different response:

{
  "ok": true,
  "userCtx": {
    "name": "jack",
    "roles": []
  },
  "info": {
    "authentication_db": "_users",
    "authentication_handlers": [
      "cookie",
      "default"
    ],
    "authenticated": "cookie"
  }
}

Is this standard behaviour? If it is, which key should I rely on to assume a successful authentication? Should it be res.userCtx.name or res.info.authenticated?

couchdb authentication cookies
1 Answers

This appears to be standard behavior, although it's not explicitly stated in the documentation.

However, you can tell CouchDB to return a 401 response by setting basic=true in the query like this: /_session?basic=true.

It seems to suggest that it's useful for basic authentication, but it also works with a cookie authenticated user. (tested with CouchDB 2.0.0)

user_31412400
Related