What is the difference between OIDCUnAuthActions with and without expression?

[studersi]

We have Location stanzas similar to this one:

<Location /no-auth-location>
        OIDCUnAuthAction pass
</Location>

Now we temporarily added the following OIDCUnAuthAction until we have tested the new release where this is the default behaviour:

OIDCUnAuthAction 401 "%{HTTP:X-Requested-With} == 'XMLHttpRequest' \
                     || ( -n %{HTTP:Sec-Fetch-Mode} && %{HTTP:Sec-Fetch-Mode} != 'navigate' ) \
                     || ( -n %{HTTP:Sec-Fetch-Dest} && %{HTTP:Sec-Fetch-Dest} != 'document' ) \
                     || (    ( %{HTTP_ACCEPT} !~ m#text/html# ) \
                          && ( %{HTTP_ACCEPT} !~ m#application/xhtml\+xml# ) \
                          && ( %{HTTP_ACCEPT} !~ m#\*/\*# ) )"

<Location /no-auth-location>
        OIDCUnAuthAction pass
</Location>

In this case, requests to /no-auth-location suddenly need to be authenticated (as with the auth action).

Adding an expression that is always true fixes the problem:

OIDCUnAuthAction 401 "%{HTTP:X-Requested-With} == 'XMLHttpRequest' \
                     || ( -n %{HTTP:Sec-Fetch-Mode} && %{HTTP:Sec-Fetch-Mode} != 'navigate' ) \
                     || ( -n %{HTTP:Sec-Fetch-Dest} && %{HTTP:Sec-Fetch-Dest} != 'document' ) \
                     || (    ( %{HTTP_ACCEPT} !~ m#text/html# ) \
                          && ( %{HTTP_ACCEPT} !~ m#application/xhtml\+xml# ) \
                          && ( %{HTTP_ACCEPT} !~ m#\*/\*# ) )"

<Location /no-auth-location>
        OIDCUnAuthAction pass true
</Location>

My question now is: What is the difference between the following `two configurations?

OIDCUnAuthAction pass

OIDCUnAuthAction pass true

[zandbelt]

by configuring the expression on the vhost level, it becomes the default for lower levels unless overridden explicitly again on a lower level

[studersi]

Thanks but I am not sure I understand. They are both configured in the vhost, one of them is additionally nested in a Location stanza.

The difference in behaviours occurs depending on whether there is a condition or not. While they both work, they seem to have different priority depending on whether the condition is set to true or omitted.

[zandbelt]

if the expression is omitted, it will be inherited from the top level, but used to detect when to return "pass" instead of "auth"

[studersi]

I see, thank you for the clarification.

[zandbelt]

thinking a bit more about this, it does not seem logical (in addition to breaking backwards compatibility) so I am considering changing this to not inherit the expression when OIDCUnAuthAction is defined at a lower level again

[studersi]

I agree. To me, the current behaviour does not seem intuitive either.

If I understand correctly, the following two are equivalent. Is that correct?

OIDCUnAuthAction 401 "%{HTTP:X-Requested-With} == 'XMLHttpRequest' \
                     || ( -n %{HTTP:Sec-Fetch-Mode} && %{HTTP:Sec-Fetch-Mode} != 'navigate' ) \
                     || ( -n %{HTTP:Sec-Fetch-Dest} && %{HTTP:Sec-Fetch-Dest} != 'document' ) \
                     || (    ( %{HTTP_ACCEPT} !~ m#text/html# ) \
                          && ( %{HTTP_ACCEPT} !~ m#application/xhtml\+xml# ) \
                          && ( %{HTTP_ACCEPT} !~ m#\*/\*# ) )"

<Location /no-auth-location>
        OIDCUnAuthAction pass
</Location>

OIDCUnAuthAction 401 "%{HTTP:X-Requested-With} == 'XMLHttpRequest' \
                     || ( -n %{HTTP:Sec-Fetch-Mode} && %{HTTP:Sec-Fetch-Mode} != 'navigate' ) \
                     || ( -n %{HTTP:Sec-Fetch-Dest} && %{HTTP:Sec-Fetch-Dest} != 'document' ) \
                     || (    ( %{HTTP_ACCEPT} !~ m#text/html# ) \
                          && ( %{HTTP_ACCEPT} !~ m#application/xhtml\+xml# ) \
                          && ( %{HTTP_ACCEPT} !~ m#\*/\*# ) )"

<Location /no-auth-location>
        OIDCUnAuthAction pass "%{HTTP:X-Requested-With} == 'XMLHttpRequest' \
                     || ( -n %{HTTP:Sec-Fetch-Mode} && %{HTTP:Sec-Fetch-Mode} != 'navigate' ) \
                     || ( -n %{HTTP:Sec-Fetch-Dest} && %{HTTP:Sec-Fetch-Dest} != 'document' ) \
                     || (    ( %{HTTP_ACCEPT} !~ m#text/html# ) \
                          && ( %{HTTP_ACCEPT} !~ m#application/xhtml\+xml# ) \
                          && ( %{HTTP_ACCEPT} !~ m#\*/\*# ) )"
</Location>