prestodb/presto

Incorrect HTTP response code 500 is returned when the password is too long

Open

#25679 opened on Aug 4, 2025

View on GitHub
 (4 comments) (0 reactions) (0 assignees)Java (15,558 stars) (5,240 forks)batch import
buggood first issue

Description

When file-based authentication is enabled, and the password is too long, the server responds with HTTP 500, not the expected HTTP 401

Your Environment

  • Presto version used: 0.294-SNAPSHOT
  • Storage (HDFS/S3/GCS..):
  • Data source and connector used:
  • Deployment (Cloud or On-prem): on-prem with Docker Swarm
  • Pastebin link to the complete debug logs: https://pastebin.com/SvU1KCpQ

Expected Behavior

The server should return HTTP 401.

Current Behavior

The server should return HTTP 401.

Possible Solution

Catch the RuntimeException and wrap it into a PrestoException.

Steps to Reproduce

Screenshots (if appropriate)

Context

Contributor guide

Tech stack
java
Domain
backend
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
JavaBasic Presto architecture
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75
Research direction
The issue is about file based authentication returning 500 instead of 401. The fix involves catching RuntimeException and wrapping it into a PrestoException. Look at the authentication related classes under presto main/src/main/java/com/facebook/presto/server/security/ or similar. The PrestoException class can be found in presto spi. There are comments in the issue suggesting the approach. Ensure the fix returns 401 for bad password length rather than 500.