Warehouse: [Non-prefixed API tokens] may cause HTTP 500 Internal Server Error

[webknjaz]

Describe the bug

Following this Tweeter thread https://twitter.com/cedrickrier/status/1156922196213805056?s=19 it seems like using a @token username and a non-prefixed token as a password results in HTTP 500 response which probably means a traceback in the backend logs.
Needs to be verified tho.

Expected behavior

HTTP 403

To Reproduce

N/A

My Platform

N/A

Additional context

N/A

[brainwane]

cc @cedk who reported this.

[brainwane]

Per our conversation in a planning meeting a few days ago, some of our upcoming fixes will probably address this -- I'll keep an eye on it.

[di]

I think the real issue here is that folks are interpreting the pypi: prefix as not part of the token. Changing the prefix may not resolve that issue.

[webknjaz]

Totally! I think that maybe some warning ⚠ there would be helpful.

[webknjaz]

But still the HTTP error code shouldn't be 500.

[di]

Agreed, @woodruffw can we do a better job of catching this issue?

[woodruffw]

Yep, we can. I'll take a look at it tomorrow!

[woodruffw]

Just tried reproducing this on master by dropping pypi- from the token, but didn't receive a 500 error (got the expected 403).

My steps:

1. Create a new token with "user" scope
2. Copy the token, minus pypi- prefix, to my .pypirc
3. twine upload --repository localhost dist/*

@webknjaz Do you have any additional information that could help me repro here?

[webknjaz]

Sorry, I only know what's in that Twitter thread.

[di]

Fixed in #6384.