HTTP Interface does not work with SCRAM User Documents

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Done
    • Priority: Major - P3
    • None
    • Affects Version/s: 3.0.0-rc11
    • Component/s: Security
    • None
    • Fully Compatible
    • ALL
    • Hide

      1. Run a 3.0 server with --auth and --httpinterface both enabled, no user documents present.
      2. Create a new user.
      3. Attempt to access the http interface with the user's credentials.

      Show
      1. Run a 3.0 server with --auth and --httpinterface both enabled, no user documents present. 2. Create a new user. 3. Attempt to access the http interface with the user's credentials.
    • None
    • 3
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      The HTTP Interface code (db/dbwebserver.cpp) was never updated to work with SCRAM-style user documents, and thus is not compatible with the new user document format. However, the interface still works with 2.6-style user documents in a 3.0 database that have not yet been updated.

      Alternatively, we could deprecate support for the HTTP interface with auth enabled (or entirely) as it is a potential security risk.

              Assignee:
              DO NOT USE - Backlog - Platform Team
              Reporter:
              Amalia Hawkins (Inactive)
              Votes:
              3 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: