Knock: Why 404 not found for invalid credentials?

[maxcal]

When posting to /knock/auth_token with bad credentials it returns 404. Which is somewhat unexpected. 401 Not Authorized seems more appropriate. Comments?

[nsarno]

This is a security best practice to avoid confirming the existence of a user when bad credentials are provided. The 404 in this case means we did not find a user matching the given credentials.

[maxcal]

Makes sense. Cheers

[FNGR2911]

Damn and I thought I was stupid. Maybe something for Docs/README?

[nsarno]

@FNGR2911 I updated the README.

[mhuggins]

I don't agree with the approach to use a 404, but that's just me. If you want to change it, simply add the following to your UserTokensController:

rescue_from Knock.not_found_exception_class_name, with: :bad_request

def bad_request
  render json: { error: "Invalid email address/password" }, status: :bad_request
end

You can change the error format/messaging/status to whatever suits your app's need.

[scudco]

@nsarno can you link to anything about 404 for an authentication POST being best practice?

Unauthorized access to a resource via GET resulting in a 404 makes sense (exactly as github does), but a 404 for a POST does not seem correct. A 404 would actually mean that there is no such resource at the endpoint (i.e., that /user-token is not a path the server understands). That resource does exist, but the credentials are wrong. A 401 seems most appropriate and does not need to reveal any information about whether or not a user exists.

[renemendoza]

what about customizing the JSON response for invalid credentials? is there an official way or should we go the way described by @mhuggins ?

[BortoBoy]

@mhuggins i had spent a lot of time trying to find this information. Where did you find it ?

[mhuggins]

I don't recall, it was 2.5 years ago. 😄

[alcidesjunior]

I don't agree with the approach to use a 404, but that's just me. If you want to change it, simply add the following to your UserTokensController:

rescue_from Knock.not_found_exception_class_name, with: :bad_request

def bad_request
  render json: { error: "Invalid email address/password" }, status: :bad_request
end

You can change the error format/messaging/status to whatever suits your app's need.
Do You know how I can custom all errors messages providing from http?
Thank you.

[alcidesjunior]

@nsarno can you link to anything about 404 for an authentication POST being best practice?

Unauthorized access to a resource via GET resulting in a 404 makes sense (exactly as github does), but a 404 for a POST does not seem correct. A 404 would actually mean that there is no such resource at the endpoint (i.e., that /user-token is not a path the server understands). That resource does exist, but the credentials are wrong. A 401 seems most appropriate and does not need to reveal any information about whether or not a user exists.

I agree!