WEBrick sending wrong http status code?

rubyonrails-talk
#1

Testing my login page, when I POST the wrong password I should expect
a 401 Unauthorized http status code back. Here is the session#create
controller method where I use :status => :unauthorized (using
sproutcore, so I'm returning JSON):

  def create
    user = User.authenticate(params[:email], params[:password])
    if user.nil?
      puts("debug: user did not authenticate")

      respond_to do |format|
        format.json do
          render(:json => {:status => :unauthorized}) ##### return 401 ######
        end
      end

    else
      puts("user: #{user}")
      sign_in(user)
      respond_to do |format|
        format.json do
          render(:json => {:content => json_for_user(user), :location
=> user_path(user)})
        end
      end
    end
  end

here's what the WEBrick console is showing me:

Started POST "/sessions" for 127.0.0.1 at 2011-05-07 23:28:36 -0400
  Processing by SessionsController#create as JSON
  Parameters: {"email"=>"a@b.com", "password"=>"[FILTERED]"}
  User Load (0.4ms) SELECT "users".* FROM "users" WHERE
"users"."email" = 'a@b.com' LIMIT 1
Completed 200 OK in 29ms (Views: 1.7ms | ActiveRecord: 0.4ms)

here is what Sproutcore is getting back:

~ PROXY: POST 200 /sessions -> http://localhost:3000/sessions
   content-type: application/json; charset=utf-8
   etag: "0bfdc0989b2b4dfb5706ab29694db1cc"
   cache-control: max-age=0, private, must-revalidate
   x-ua-compatible: IE=Edge
   x-runtime: 0.049420
   server: WEBrick/1.3.1 (Ruby/1.9.2/2011-02-18)
   date: Sun, 08 May 2011 03:28:36 GMT
   content-length: 25
   set-cookie: _mercury_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlZWEzNjk0YTA0NDQyYjZhYTE5MjJlOWRkMDU2NWEyMmM%3D--d117484163dcb37bcc5928c2edd4d0a9ad4bcda2;
path=/; HttpOnly

Why isn't rails sending back a 401? Am I doing something wrong?

Michael

Why would the web server

#2

Testing my login page, when I POST the wrong password I should expect
a 401 Unauthorized http status code back. Here is the session#create
controller method where I use :status => :unauthorized (using
sproutcore, so I'm returning JSON):

What your code is actually doing is producing a 200 response, whose body is {status: "unauthorised"}.

The http status to return goes at the top level, eg render :status => :unauthorized, ... (you can use the head method if you don't want to provide a body, eg head :unauthorized )

Fred

#3

Thanks, this helped. For future reference, the code I wrote that
worked is:

format.json {head(:unauthorized)}

Michael