github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-05-11 08:20:40 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[PR #1756] [MERGED] fix: 403 http error code on failed login #3659

New Issue
Closed
opened 2026-03-22 14:50:25 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-22 14:50:25 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/go-vikunja/vikunja/pull/1756
Author: @pano9000
Created: 11/6/2025
Status: ✅ Merged
Merged: 11/6/2025
Merged by: @kolaente

Base: main ← Head: fix_HTTP-error-code-on-failed-login

📝 Commits (2)

  • 4ce832e chore: fix copy/paste error in comment
  • 8f7a92e fix: send 403 http.StatusForbidden for ErrWrongUsernameOrPassword

📊 Changes

1 file changed (+3 additions, -3 deletions)

View changed files

📝 pkg/user/error.go (+3 -3)

📄 Description

Hi,

this PR is doing a minor change to the error code that the API returns back for a failed login, when the wrong username or password is provided.

The swagger docs are reporting to expect a 403 error code, as mentioned here:
5987874165/pkg/routes/api/v1/login.go (L45)

However it was sending actually sending a http.StatusPreconditionFailed (so a 412 code).

With the change it should now send a http.StatusForbidden (so a 403) as documented (and it makes a bit more sense than 412 as well IMHO).

Reason I noticed it:
Was trying to set up fail2ban with a TOTP enabled account, but manually testing discovered, that even when I put in nonsense values in the first "login stage" (i.e. where you enter user + pass, BEFORE you get the TOTP field displayed), I got a 412 back, instead of a 403.

The fail2ban documentation also does not need to be updated, it already assumes 400, 403 and 412 as failure codes.

And while I was at it, I did a tiny copy/paste error correction on some comments

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/go-vikunja/vikunja/pull/1756 **Author:** [@pano9000](https://github.com/pano9000) **Created:** 11/6/2025 **Status:** ✅ Merged **Merged:** 11/6/2025 **Merged by:** [@kolaente](https://github.com/kolaente) **Base:** `main` ← **Head:** `fix_HTTP-error-code-on-failed-login` --- ### 📝 Commits (2) - [`4ce832e`](https://github.com/go-vikunja/vikunja/commit/4ce832e4ca68aa749fbd432ef1d5437baa6062dc) chore: fix copy/paste error in comment - [`8f7a92e`](https://github.com/go-vikunja/vikunja/commit/8f7a92ec1409e41946250161488f0b85ad489ea1) fix: send 403 http.StatusForbidden for ErrWrongUsernameOrPassword ### 📊 Changes **1 file changed** (+3 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `pkg/user/error.go` (+3 -3) </details> ### 📄 Description Hi, this PR is doing a minor change to the error code that the API returns back for a failed login, when the wrong username or password is provided. The swagger docs are reporting to expect a `403` error code, as mentioned here: https://github.com/go-vikunja/vikunja/blob/59878741659c3f5335acd5bdd96842c69ac0778f/pkg/routes/api/v1/login.go#L45 However it was sending actually sending a `http.StatusPreconditionFailed` (so a `412` code). With the change it should now send a `http.StatusForbidden` (so a `403`) as documented (and it makes a bit more sense than `412` as well IMHO). Reason I noticed it: Was trying to set up fail2ban with a TOTP enabled account, but manually testing discovered, that even when I put in nonsense values in the first "login stage" (i.e. where you enter user + pass, BEFORE you get the TOTP field displayed), I got a `412` back, instead of a `403`. The [fail2ban documentation](https://vikunja.io/docs/fail2ban/) also does not need to be updated, it already assumes 400, 403 and 412 as failure codes. ---- And while I was at it, I did a tiny copy/paste error correction on some comments --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-22 14:50:25 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#3659
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?