-
Suggestion
-
Resolution: Unresolved
-
None
-
None
-
1
-
Problem Definition
- Create some page restricted to user A.
- Login Confluence with user B.
- Access to the page created in step 1.
Then you will see the "No permission" screen. However it's responded as 200.
This was confirmed in Confluence 6.8.1.
Suggested Solution
It should return 403 forbidden or 404 not found.
Why this is important
- When thinking of page access audit with How to Enable User Access Logging, there's no way to detect "No permission" access attempt.
[CONFSERVER-55343] "No permission" page should return status 4xx
Workflow | Original: JAC Suggestion Workflow 4 [ 3563836 ] | New: JAC Suggestion Workflow 3 [ 4341102 ] |
Workflow | Original: JAC Suggestion Workflow 2 [ 3171109 ] | New: JAC Suggestion Workflow 4 [ 3563836 ] |
Remote Link | New: This issue links to "Page (Confluence)" [ 449125 ] |
Remote Link | New: This issue links to "Page (Confluence)" [ 447505 ] |
Workflow | Original: JAC Suggestion Workflow [ 3032116 ] | New: JAC Suggestion Workflow 2 [ 3171109 ] |
Workflow | Original: Confluence Workflow - Public Facing v4 [ 2656325 ] | New: JAC Suggestion Workflow [ 3032116 ] |
Support reference count | New: 1 |
Description |
Original:
h3. Problem Definition
# Create some page restricted to user A. # Login Confluence with user B. # Access to the page created in step 1. Then you will see the "No permission" screen. However it's responded as 200. !Screen_Shot_2018-04-12_at_9_17_26.png|width=680,height=332! h3. Suggested Solution It should return 403 forbidden or 404 not found. h3. Why this is important * When thinking of page access audit with [How to Enable User Access Logging|https://confluence.atlassian.com/confkb/how-to-enable-user-access-logging-182943.html], there's no way to detect "No permission" access attempt. |
New:
h3. Problem Definition
# Create some page restricted to user A. # Login Confluence with user B. # Access to the page created in step 1. Then you will see the "No permission" screen. However it's responded as 200. !Screen_Shot_2018-04-12_at_9_17_26.png|width=680,height=332! This was confirmed in Confluence 6.8.1. h3. Suggested Solution It should return 403 forbidden or 404 not found. h3. Why this is important * When thinking of page access audit with [How to Enable User Access Logging|https://confluence.atlassian.com/confkb/how-to-enable-user-access-logging-182943.html], there's no way to detect "No permission" access attempt. |
Hi all,
Thank you so much for your votes and comments on this suggestion.
We are beginning greater research on the topic of advanced auditing and would love to hear from you.
We intend to better understand:
Responses can be in regard to information that needs to be tracked for internal policies (i.e. security) or compliance standards (i.e. SOC2 or SOX)
What’s involved in the research:
If you're interested in taking part, please send me an email at rbattaglin@atlassian.com
and I'll get in touch. We can't guarantee that all interested parties will be selected but we appreciate your interest in helping us to make auditing in our products satisfy more advanced use cases.
We look forward to meeting you!
Cheers,
Renan Battaglin
Server and Data Center Team