search

OlhenShu / ProjectStage_Team2_May

0 stars 0 forks source link

[Eco-News, DELETE /econews/{econewsId}] The 400 (Bad request) response code is returned instead of 403 (Forbidden) #286

Closed OlhenShu closed 4 months ago

OlhenShu commented 4 months ago

Environment: Windows 11 Home Chrome 114.0.5735.91 (Official buid) (64-bit) GreenCityDocker-3 is built and running.

Reproducible: always.

Pre-conditions: User is logged in as Authorized User. There is an Econews created by another User.

Steps to reproduce

  1. Select the “Eco-news" controller.
  2. Select the method DELETE /econews/{econewsId} .
  3. Set the "Id" of the econews created by another User as the value of the "econewsId' parameter'.
  4. Send the request.
  5. Pay attention to the response.

Actual result: Response code 400 (Bad request) with body ({ "message": "Current user has no permission for this action"}) is returned

Expected result: Response code 403 (Forbidden) is returned