fix(handlers): verify handler (#3956)

When an anonymous user tries to access a forbidden resource with no subject, we should response with 403.

Fixes #3084

1 files changed, 3 insertions, 3 deletions

diff --git a/internal/authorization/authorizer.go b/internal/authorization/authorizer.go
index 3b6e75f74..d08ec3a5b 100644
--- a/internal/authorization/authorizer.go
+++ b/internal/authorization/authorizer.go
@@ -54,7 +54,7 @@ func (p Authorizer) IsSecondFactorEnabled() bool {
 }
 
 // GetRequiredLevel retrieve the required level of authorization to access the object.
-func (p Authorizer) GetRequiredLevel(subject Subject, object Object) Level {
+func (p Authorizer) GetRequiredLevel(subject Subject, object Object) (bool, Level) {
 	logger := logging.Logger()
 
 	logger.Debugf("Check authorization of subject %s and object %s (method %s).",
@@ -64,7 +64,7 @@ func (p Authorizer) GetRequiredLevel(subject Subject, object Object) Level {
 		if rule.IsMatch(subject, object) {
 			logger.Tracef(traceFmtACLHitMiss, "HIT", rule.Position, subject.String(), object.String(), object.Method)
 
-			return rule.Policy
+			return len(rule.Subjects) > 0, rule.Policy
 		}
 
 		logger.Tracef(traceFmtACLHitMiss, "MISS", rule.Position, subject.String(), object.String(), object.Method)
@@ -73,7 +73,7 @@ func (p Authorizer) GetRequiredLevel(subject Subject, object Object) Level {
 	logger.Debugf("No matching rule for subject %s and url %s... Applying default policy.",
 		subject.String(), object.String())
 
-	return p.defaultPolicy
+	return false, p.defaultPolicy
 }
 
 // GetRuleMatchResults iterates through the rules and produces a list of RuleMatchResult provided a subject and object.