# HG changeset patch
# User Jonas Schäfer <jonas@wielicki.name>
# Date 1634654252 -7200
# Node ID ae5ac9830add772516c7622ff005e1eaa37692e5
# Parent  71266f43699d90ad2e0f4e9016b5fe2f7dac701f
mod_http_file_share: return 401 instead of 403 if authentication failed

This is as per the HTTP standards [1]. Thankfully, the REQUIRED
www-authenticate header is already generated by the code.

   [1]: https://datatracker.ietf.org/doc/html/rfc7235#section-3.1

diff -r 71266f43699d -r ae5ac9830add plugins/mod_http_file_share.lua
--- a/plugins/mod_http_file_share.lua	Sun Oct 17 17:07:29 2021 +0200
+++ b/plugins/mod_http_file_share.lua	Tue Oct 19 16:37:32 2021 +0200
@@ -249,7 +249,7 @@
 	if not authz then
 		module:log("debug", "Missing or malformed Authorization header");
 		event.response.headers.www_authenticate = "Bearer";
-		return 403;
+		return 401;
 	end
 	local authed, upload_info = jwt.verify(secret, authz);
 	if not (authed and type(upload_info) == "table" and type(upload_info.exp) == "number") then