UAA returns JSON error responses with incorrect media type.

What version of UAA are you running?

v74.30.0

What output do you see from curl <YOUR_UAA>/info -H'Accept: application/json'?

{"app":{"version":"74.30.0"},"links":{"uaa":"http://localhost:8080/uaa","passwd":"/forgot_password","login":"http://localhost:8080/uaa","register":"/create_account"},"zone_name":"uaa","entityID":"cloudfoundry-saml-login","commit_id":"8d26cf2","idpDefinitions":{},"prompts":{"username":["text","Email"],"password":["password","Password"]},"timestamp":"2021-01-13T15:37:01-0800"}

How are you deploying the UAA?

I am deploying the UAA

• locally only using gradlew

What did you do?

• Download UAA 74.30.0 from GitHub
• Run the UAA locally using ./gradlew run
• Call (most?) APIs with an invalid query parameter or an invalid request body

What did you expect to see? What goal are you trying to achieve with the UAA?

In all cases, UAA returns a valid JSON response similar to this:

{"error_description":"Invalid filter expression: [foo] [created]","error":"scim","message":"Invalid filter expression: [foo] [created]"}{"error_description":"Invalid filter expression: [foo] [created]","error":"scim","message":"Invalid filter expression: [foo] [created]"}

The Content-Type response header should always be application/json to match this response body.

What did you see instead?

If we pass in different Accept request headers, the response Content-Type header changes. The response body is still in the JSON format above.

Accept request header	Content-Type response header	Valid
unspecified	application/octet-stream;charset=ISO-8859-1	✖️
*/*	application/octet-stream;charset=ISO-8859-1	✖️
application/json;charset=UTF-8	application/json;charset=UTF-8	✔️
application/json	application/json;charset=ISO-8859-1	✔️1
application/json,*/*	application/json;charset=ISO-8859-1	✔️1
application/json,text/html	application/json;charset=ISO-8859-1	✔️1
*/*,application/json	application/json;charset=ISO-8859-1	✔️1
text/html,application/json	text/html;charset=ISO-8859-1	✖️
text/html,*/*	text/html;charset=ISO-8859-1	✖️

^[1] The JSON format uses ISO-8859-1 encoding, but RFC 8259 restricts it to UTF-8. See https://github.com/spring-projects/spring-framework/issues/22788 for more information.

This issue does not seem to be restricted to a specific API. It was tested on the following APIs:

• GET /v1/Users
• PUT /v1/Users/{userId}
• GET /v1/Groups
• PUT /v1/Groups/{groupId}
• POST /v1/Groups/{groupId}/members

[metacubed]

Those handlers all seem to be using a ConvertingExceptionView to convert an ExceptionReport to the HTTP response. When the Accept header is absent or */*, that class tries to infer the response media type:

https://github.com/cloudfoundry/uaa/blob/3ce614a62119132aa25f78f87134b0cbe6fa43d2/server/src/main/java/org/cloudfoundry/identity/uaa/web/ConvertingExceptionView.java#L130-L133

I think this might be a better place to add the fix, so it can be used for all response handling.

[strehle]

I think this might be a better place to add the fix, so it can be used for all response handling.

ok for me, hope that not too many tests needs to be adopted