Repository navigation
SnapshotHttpHandler accepts Basic credentials when the request carries an invalid cluster token, unlike AbstractServerHttpHandler #10827
Description
Found in review of #10826 (issue #10601). This behavior predates that PR and is not changed by it.
SnapshotHttpHandler.authenticate (ha-raft) treats a present but invalid X-ArcadeDB-Cluster-Token as if the header were absent, and falls through to the Authorization (Basic) check. A request that carries a wrong cluster token together with valid root Basic credentials is therefore served the snapshot.
AbstractServerHttpHandler fails closed in the same situation: an invalid cluster token is refused with 401 before any relayed credentials are looked at. That is pinned by Issue7516ClusterTokenHopProofTest#anInvalidClusterTokenIsRefusedEvenWhenTheRelayedCredentialsAreValid. So the two cluster-token checks disagree.
Suggested fix: in SnapshotHttpHandler.authenticate, return a 401 when the cluster-token header is present and does not match, before the Basic fallback. Before doing that, check that no snapshot caller sends a stale token alongside Basic credentials on purpose (for example during the #9554 HA-lifecycle window) and depends on the fallback.
Kept out of #10826 because it changes authentication semantics on the snapshot endpoint, which needs its own review.
Activity
fix(#10827, #10801): review - authenticate() holds the token rule by …
fix(#10827, #10802, #10801, #10738): invalid cluster token refused on…
lvca commentedon Oct 28, 2026
Fixed in #10833 (26.11.1).
The HA snapshot endpoint (
GET /api/v1/ha/snapshot/{database}) now answers401 Invalid cluster tokenwhen a request carries a wrong or blankX-ArcadeDB-Cluster-Token, whatever credentials come with it. It no longer falls back to the Basic credentials. This is the same rule every other cluster route already followed.Nothing in the cluster relied on the fallback: the snapshot download between nodes sends only the cluster token. An operator can still download a snapshot with
root's Basic credentials, as long as no cluster token is sent.❤️ Thanks for helping make ArcadeDB better! ArcadeDB is free and open source, sustained by its community. If it's useful to you or your company, please consider becoming a sponsor to keep development going.
Merge branch 'main' into fix/10601-derived-cluster-token-rotation
fix(#10827, #10802, #10801, #10738): invalid cluster token refused on…