Any request carrying an invalid token answers 502:
GET /user/info -H "Authorization: Bearer no-vale"
502 {"detail": "Authentication service returned unexpected response (HTTP 400)."}
The authentication service answers 400 for a token it cannot accept, and get_current_user maps every status it does not recognise to 502, on the reasoning that an unexpected answer means the service is misbehaving. 400 is not that: it is the service saying the token is no good, which is a 401.
So a user who mistypes or pastes an expired token is told the Endpoint's authentication service is broken. It also makes a genuine outage indistinguishable from a bad credential, which is exactly what the 0.33.5 fix set out to separate.
Any request carrying an invalid token answers
502:The authentication service answers
400for a token it cannot accept, andget_current_usermaps every status it does not recognise to502, on the reasoning that an unexpected answer means the service is misbehaving.400is not that: it is the service saying the token is no good, which is a401.So a user who mistypes or pastes an expired token is told the Endpoint's authentication service is broken. It also makes a genuine outage indistinguishable from a bad credential, which is exactly what the 0.33.5 fix set out to separate.