Document route-owned authentication fallthrough - #663
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the documentation to explain the new route-owned authentication and fallthrough behavior introduced in version 5.3.0. The feedback suggests splitting sentences in the HTTP overview and release notes to present critical security warnings and fallback behaviors in separate, distinct sentences, improving readability and scannability.
🚀 Preview DeploymentYour preview deployment is ready! 🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-663 This preview will update automatically when you push new commits. |
🚀 Preview DeploymentYour preview deployment is ready! 🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-663 This preview will update automatically when you push new commits. |
Review on HarperFast/harper#2419 found that authentication was re-decorating any 401 returned up the chain: overwriting WWW-Authenticate with Basic, or rewriting it to a login-page redirect for a browser. That silently replaced an application catch-all's own challenge, which is the case this feature exists to support. The fix scopes that rewriting away from deferred credentials, so the externally visible contract now includes response provenance. Also records the WebSocket/MQTT upgrade outcome for an unrecognized credential. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
🚀 Preview DeploymentYour preview deployment is ready! 🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-663 This preview will update automatically when you push new commits. |
3 participants
Documents the route-ownership authentication contract introduced by HarperFast/harper#2419 in the security boundary, HTTP fallthrough contract, and v5.3 release notes. No configuration schema documentation changes are needed because the behavior is automatic and adds no setting.
For the human reviewer
Verification
05e6ba2c65d79853ebcd8f8aab55508aefe1397bcompleted successfully and generated 406 documents.afc7430ea9cb1f75e88f964da02ca13c94b232d0; current head05e6ba2implements its two sentence-separation findings, with both threads replied to and resolved.Complexity: easy
Review-Coverage: authored=codex; ran=gemini; adjudicated=codex; rounds=1 @ afc7430
Human-Review-Need: 4 @ 05e6ba2