get_current_user wraps its whole body in a try and ends with a bare except Exception that re-raises everything as 401 "Authentication failed".
Because the HTTPException(502) branches for an unreachable or failing authentication service are raised inside that same try, they are caught by it too. A 502 the code deliberately built — "the authentication service is experiencing internal issues" — reaches the user as a 401.
The practical effect is that any failure in the authentication chain is presented as a bad token. A user reading "Invalid token" reasonably concludes they mistyped a credential or that their session expired, when the actual cause may be that the AAI is down, misconfigured, or returning an error for a token that is perfectly valid.
This was hit while configuring identity-provider sign-in: the AAI returned a 500 because the token carried no sub claim, and the UI reported invalid credentials. Diagnosing it required reading the AAI source and reproducing the flow by hand, because the response said nothing about what had actually gone wrong.
Statuses that are not authentication failures should not be reported as authentication failures, and the reason a request could not be authenticated should survive to the caller.
get_current_userwraps its whole body in atryand ends with a bareexcept Exceptionthat re-raises everything as 401 "Authentication failed".Because the
HTTPException(502)branches for an unreachable or failing authentication service are raised inside that sametry, they are caught by it too. A 502 the code deliberately built — "the authentication service is experiencing internal issues" — reaches the user as a 401.The practical effect is that any failure in the authentication chain is presented as a bad token. A user reading "Invalid token" reasonably concludes they mistyped a credential or that their session expired, when the actual cause may be that the AAI is down, misconfigured, or returning an error for a token that is perfectly valid.
This was hit while configuring identity-provider sign-in: the AAI returned a 500 because the token carried no
subclaim, and the UI reported invalid credentials. Diagnosing it required reading the AAI source and reproducing the flow by hand, because the response said nothing about what had actually gone wrong.Statuses that are not authentication failures should not be reported as authentication failures, and the reason a request could not be authenticated should survive to the caller.