272 views

Description

A SOAP request with insufficient privileges yields a 200 response and empty response message instead of a 403 (Forbidden) error

Steps to Reproduce

  1. Create a new Outbound SOAP Message, using the WSDL for any table in the instance that contains records

  2. Create a user or use an existing user who does not have authorization to READ from this table.

  3. Edit the GetRecords function on the SOAP Message and set Basic Auth Profile as the unauthorized user.

  4. Edit the GetRecords function on the SOAP Message and remove any <!--Optional:--> items, so that the <sys:getRecords> element exists with empty data

  5. Execute the GetRecords function.

Note the 200 response code and empty response body.

 

 

Workaround

Using SOAP, there is no workaround available to obtain a 403 Forbidden error instead of the 200 response that is currently being returned. However, the equivalent REST endpoint will yield a 403 Forbidden error.


Related Problem: PRB711215

Seen In

There is no data to report.

Associated Community Threads

There is no data to report.

Article Information

Last Updated:2016-10-06 16:06:51
Published:2016-09-07