return a 401 instead of a 500 when a token is rejected

liboauth2 up to 2.3.0 does not set the "status_code" out-parameter of
oauth2_token_verify for a failure it detects locally, i.e. for any JWT that is
expired, carries a bad signature or fails "iss"/"aud"/"nbf" validation. It then
keeps the 0 it was initialized with, which is returned here as an Apache return
code and thus means OK; with no user set Apache logs "AH00027: No
authentication done but request not allowed without authentication" and returns
a 500. An introspection endpoint answering "active": false similarly left the
200 of that successful call behind.

Invert the test so that no non-error status can escape: only a 5xx is relayed
as-is, anything else results in a 401 with a WWW-Authenticate header, as it did
before 4.1.0 started leveraging the status code.

liboauth2 >= 2.3.1 sets the status code itself, but keeping the check here also
covers the older versions that are already packaged.

closes #94

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: zandbelt

ChangeLog

@@ -1,3 +1,15 @@
+08/01/2026
+- return a 401 instead of a 500 when a token is rejected without an HTTP status
+  code being set by liboauth2, which is the case for any locally detected JWT
+  verification failure i.e. expiry, signature mismatch, "iss"/"aud"/"nbf"
+  validation; the unset status code (0) was returned to Apache as OK, without a
+  user being set, upon which Apache logs "AH00027: No authentication done but
+  request not allowed without authentication" and returns a 500; only a 5xx is
+  now relayed as-is, anything else results in a 401 with a WWW-Authenticate
+  header; liboauth2 >= 2.3.1 sets the status code itself, this covers older
+  versions as well
+  thanks @smanolache; closes #94
+
 05/23/2026
 - depend on liboauth2 >= 2.2.1 with updated so.1 link
 - release 4.2.0

src/mod_oauth2.c

@@ -114,12 +114,21 @@ static int oauth2_request_handler(oauth2_cfg_source_token_t *cfg,
 
 	if (oauth2_token_verify(ctx->log, ctx->request, verify, source_token,
 				&json_token, &status_code) == false) {
-		if ((status_code >= 400) && (status_code < 500)) {
+		// a server error is relayed as-is; anything else results in a
+		// 401 with a WWW-Authenticate header, including a status code
+		// that was left unset (0) by an older liboauth2, since
+		// returning that to Apache would signal OK without a user
+		// being set, which results in a 500 (AH00027)
+		if ((status_code >= 500) && (status_code < 600)) {
+			rv = status_code;
+		} else {
 			rv = oauth2_apache_return_www_authenticate(
-			    cfg, ctx, status_code, OAUTH2_ERROR_INVALID_TOKEN,
+			    cfg, ctx,
+			    ((status_code >= 400) && (status_code < 500))
+				? status_code
+				: HTTP_UNAUTHORIZED,
+			    OAUTH2_ERROR_INVALID_TOKEN,
 			    "Token could not be verified.");
-		} else {
-			rv = status_code;
 		}
 		goto end;
 	}