Feature #26677
closed
HTTP code 401 on login failure
0%
Description
When purposely causing a login error on Redmine, I can see (using web inspector and/or logfiles) that the HTTP return code is 200, i.e. "everything is ok", for the page that presents the error to the user.
It would be great if Redmine would return a 401 ("Unauthorized", see here: https://en.wikipedia.org/wiki/List_of_HTTP_status_codes#4xx_Client_errors).
Indeed, I think a 401 code in the webserver logs has great security value, and makes it easy to integrate with solutions such as Fail2Ban and others.
If this change were made, there should be absolutely no impact on the user.
Updated by Holger Just over 6 years ago
The 401 status code is specifically used for Basic or Digest authentication. It has no value when using form authentication as done with Redmine.
If Redmine would return a 401 here, your browser would ask for authentication with a Basic-Auth form, similar to
This not what we want. As such, returning a 200 is okay here for the user. When querying the API, we do already return a 401 if the user did not provide any credentials along with their request. API clients are equipped to deal with this.
Updated by Rémi Saurel over 6 years ago
This is not what I obtain with other services (e.g. with Jenkins CI instances), where a 401 code is returned, and presents the usual HTML login form (not through the browser, as the authentication is made through the application, not the web server).
Updated by