Rest API /api/authentication/validate has unexpected results

SonarQube Server / Community Build
,
1

Said API /api/authentication/validate when called with Sonar Cloud to validate the token -

  • With no Authorization header - returning { "valid": true } - :x:
  • With Authorization header with correct bearer token - returning { "valid": true } - :white_check_mark:
  • With Authorization header with incorrect bearer token - returning { "valid": false } - :white_check_mark:

When called with Sonarqube Enterprise Edition Version 10.2.1 where SAML is enabled -

  • With any Authorization header - returning { "valid": false } - :x:

Is there any limitation/issues/additional steps for expected results? Didn’t find anything specific in documentation.

2

Hey there.

Since SonarCloud allows some level of public access (to view public projects), I think this is expected.

I can reproduce this on 10.3, and that’s definitely weird. I’ll flag this for attention.

6

Hello @kunal-mazumdar,

There is indeed an issue with this endpoint, the token validation is not done properly.
A ticket was created to follow the issue: SONAR-21116

Thank you for the report!

1 Like