From a0a8bfa27ded8a3f5262ce843d14aafbbb6b0622 Mon Sep 17 00:00:00 2001
From: Norbert de Langen <ndelangen@me.com>
Date: Fri, 6 May 2022 14:25:02 +0200
Subject: [PATCH] When we do server-checks we naively assume that when
 requesting the resource, we'll get a 200 response only when the resource was
 accessible.

But in actuallity it's normal for a 200 statusCode to be returned but it's actually an authentication page.

I added an additional check to re-request the resource with an accept-header, and check the absence of a loginUrl field on the JSON response.

If the response is not valid JSON this additional check is ignored, and the previously behavior is preserved.
---
 lib/manager-webpack4/src/manager-config.ts | 22 ++++++++++++++++++++--
 lib/manager-webpack5/src/manager-config.ts | 22 ++++++++++++++++++++--
 2 files changed, 40 insertions(+), 4 deletions(-)

diff --git a/lib/manager-webpack4/src/manager-config.ts b/lib/manager-webpack4/src/manager-config.ts
index 53655c3caf4b..a64a18ed3943 100644
--- a/lib/manager-webpack4/src/manager-config.ts
+++ b/lib/manager-webpack4/src/manager-config.ts
@@ -42,8 +42,26 @@ export const getAutoRefs = async (
 };
 
 const checkRef = (url: string) =>
-  fetch(`${url}/iframe.html`).then(
-    ({ ok }) => ok,
+  fetch(`${url}/iframe.html`, {
+    headers: {
+      Accept: 'application/json',
+    },
+  }).then(
+    async ({ ok }) => {
+      if (ok) {
+        // so the status is ok, but if we'd ask for JSON we might get a response saying we need to authenticate.
+        const data = await fetch(`${url}/iframe.html`, {
+          headers: {
+            Accept: 'application/json',
+          },
+        });
+        // we might receive non-JSON as a response, because the service ignored our request for JSON response type.
+        if (data.ok && (await data.json().catch((e) => ({}))).loginUrl) {
+          return false;
+        }
+      }
+      return ok;
+    },
     () => false
   );
 
diff --git a/lib/manager-webpack5/src/manager-config.ts b/lib/manager-webpack5/src/manager-config.ts
index 53655c3caf4b..a64a18ed3943 100644
--- a/lib/manager-webpack5/src/manager-config.ts
+++ b/lib/manager-webpack5/src/manager-config.ts
@@ -42,8 +42,26 @@ export const getAutoRefs = async (
 };
 
 const checkRef = (url: string) =>
-  fetch(`${url}/iframe.html`).then(
-    ({ ok }) => ok,
+  fetch(`${url}/iframe.html`, {
+    headers: {
+      Accept: 'application/json',
+    },
+  }).then(
+    async ({ ok }) => {
+      if (ok) {
+        // so the status is ok, but if we'd ask for JSON we might get a response saying we need to authenticate.
+        const data = await fetch(`${url}/iframe.html`, {
+          headers: {
+            Accept: 'application/json',
+          },
+        });
+        // we might receive non-JSON as a response, because the service ignored our request for JSON response type.
+        if (data.ok && (await data.json().catch((e) => ({}))).loginUrl) {
+          return false;
+        }
+      }
+      return ok;
+    },
     () => false
   );