From 0934170d71611c942df175ca72b3ba566071ff91 Mon Sep 17 00:00:00 2001 From: James Chao Date: Fri, 2 Oct 2026 10:59:53 -0700 Subject: [PATCH] Return 400 if POST /api/v1/token has malformed body --- http/token_handler.go | 4 ++-- http/webconfig_server_test.go | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/http/token_handler.go b/http/token_handler.go index 3b9a8e3..0222534 100644 --- a/http/token_handler.go +++ b/http/token_handler.go @@ -14,7 +14,7 @@ * limitations under the License. * * SPDX-License-Identifier: Apache-2.0 -*/ + */ package http import ( @@ -46,7 +46,7 @@ func (s *WebconfigServer) CreateTokenHandler(w http.ResponseWriter, r *http.Requ // Unmarshal tokenRequest := TokenRequest{} if err := json.Unmarshal(bodyBytes, &tokenRequest); err != nil { - Error(w, http.StatusInternalServerError, err) + Error(w, http.StatusBadRequest, err) return } diff --git a/http/webconfig_server_test.go b/http/webconfig_server_test.go index a60a68f..f296e85 100644 --- a/http/webconfig_server_test.go +++ b/http/webconfig_server_test.go @@ -179,7 +179,7 @@ func TestTokenEndpointRemainsUnauthenticatedWhenDisabled(t *testing.T) { req, err := http.NewRequest("POST", "/api/v1/token", strings.NewReader("not-json")) assert.NilError(t, err) res := ExecuteRequest(req, router).Result() - assert.Equal(t, res.StatusCode, http.StatusInternalServerError) + assert.Equal(t, res.StatusCode, http.StatusBadRequest) } func TestTokenEndpointRequiresApiTokenWhenEnabled(t *testing.T) { @@ -203,7 +203,7 @@ func TestTokenEndpointUsesTestingMiddlewareInTestRouter(t *testing.T) { req, err := http.NewRequest("POST", "/api/v1/token", strings.NewReader("not-json")) assert.NilError(t, err) res := ExecuteRequest(req, router).Result() - assert.Equal(t, res.StatusCode, http.StatusInternalServerError) + assert.Equal(t, res.StatusCode, http.StatusBadRequest) } func TestConfigEndpointUsesTestingMiddlewareInTestRouter(t *testing.T) {