Bug 1322543
| Summary: | 406's returned from broker api outside of web browser | |||
|---|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Timothy Williams <tiwillia> | |
| Component: | Master | Assignee: | Rory Thrasher <rthrashe> | |
| Status: | CLOSED ERRATA | QA Contact: | Gaoyun Pei <gpei> | |
| Severity: | urgent | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 2.2.0 | CC: | aos-bugs, gpei, jokerman, mmasters, mmccomas | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | x86_64 | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | rubygem-openshift-origin-controller-1.38.5.2-1.el6op | Doc Type: | Bug Fix | |
| Doc Text: |
Cause: A recent fix for CVE-2016-0751 changed the behavior of the OpenShift REST API.
Consequence: The REST API responds with a 406 when no return type is specified, or when "*/*" is specified for the return type.
Fix: Set the default return type to JSON.
Result: The REST API will successfully return a 200 with JSON when accessed with no return type or a "*/*" return type.
|
Story Points: | --- | |
| Clone Of: | ||||
| : | 1324208 (view as bug list) | Environment: | ||
| Last Closed: | 2016-04-25 18:53:57 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1324208 | |||
|
Description
Timothy Williams
2016-03-30 17:12:36 UTC
It appears that this may be caused by the following security fix to actionpack: https://access.redhat.com/security/cve/cve-2016-0751 An accept header must now be supplied, or a 406 will be returned when no mime type is explicity supplied. Using the accept header resolves the issue: $ curl -H "accept:application/json" -Ik https://localhost/broker/rest/api However, using a wildcard type doesn't resolve the issue: $ curl -H "accept:*/*" -Ik https://localhost/broker/rest/api https://github.com/openshift/origin-server/pull/6375 should resolve this. I'm re-assigning this to Rory, who is working on this while Tim is out. Let me know if I can help out! *** Bug 1322325 has been marked as a duplicate of this bug. *** Commit pushed to master at https://github.com/openshift/origin-server https://github.com/openshift/origin-server/commit/2fee9660afb9affc3c225f426e938ed5cde76e6b controller: default to JSON for REST API If no request format is specified for an REST API call, default to responding with JSON. This commit fixes bug 1322543. https://bugzilla.redhat.com/show_bug.cgi?id=1322543 QE, This fix has had quite a lot of trouble passing tests. The test failures look to be unrelated, as they also fail without this change. Just to be safe though, can we do regression tests in addition to verification? 1) Curling the REST api with no header specified returns a successful 200. $ curl -Ik https://localhost/broker/rest/api 2) Curling the REST api with a non-json header returns successfully using the specified header. $ curl -H "accept:application/xml" -Ik https://localhost/broker/rest/api 3) Curling while specifying a */* header will successfully return (should return json). $ curl -H "accept:*/*" -Ik https://localhost/broker/rest/api 4) Regression tests to verify that this change doesn't break the REST api. Thank you Please move this to ON_QA when there's an available 2.2 puddle for QE which contains the fix , thanks! Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-0686.html |