{"record":{"id":"b023d191215de940","repo":"kubesphere/kubesphere","slug":"cannot-obtain-user-info-b023d1","errorCode":null,"errorMessage":"cannot obtain user info","messagePattern":"cannot obtain user info","errorType":"http","errorClass":null,"httpStatus":403,"severity":"warning","filePath":"pkg/kapis/workloadtemplate/v1alpha1/handler.go","lineNumber":68,"sourceCode":"\t}\n\tnamespace := req.PathParameter(\"namespace\")\n\tif namespace != \"\" {\n\t\topts = append(opts, client.InNamespace(namespace))\n\t}\n\terr := h.client.List(req.Request.Context(), &secretList, opts...)\n\tif err != nil {\n\t\tapi.HandleError(resp, req, err)\n\t\treturn\n\t}\n\tworkspace := req.PathParameter(\"workspace\")\n\tif workspace == \"\" {\n\t\tresp.WriteEntity(k8suitl.ConvertToListResult(&secretList, req))\n\t\treturn\n\t}\n\n\tuser, ok := request.UserFrom(req.Request.Context())\n\tif !ok {\n\t\terr := fmt.Errorf(\"cannot obtain user info\")\n\t\tklog.Errorln(err)\n\t\tapi.HandleForbidden(resp, nil, err)\n\t\treturn\n\t}\n\n\tfilteredList, err := h.FilterByPermissions(workspace, user, secretList)\n\tif err != nil {\n\t\tapi.HandleError(resp, req, err)\n\t\treturn\n\t}\n\n\tresp.WriteEntity(k8suitl.ConvertToListResult(filteredList, req))\n}\n\nfunc (h *templateHandler) FilterByPermissions(workspace string, user user.Info, secretList corev1.SecretList) (*corev1.SecretList, error) {\n\n\tlistNS := authorizer.AttributesRecord{\n\t\tUser:            user,","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/kubesphere/kubesphere/blob/04a29b5c601470fa6bc2f2e92358dcb802a0d414/pkg/kapis/workloadtemplate/v1alpha1/handler.go#L50-L86","documentation":"listWorkloadTemplate needs the authenticated user to filter secrets (workload templates) by workspace permissions via FilterByPermissions. If request.UserFrom finds no user in the context, the handler responds 403 Forbidden with 'cannot obtain user info'.","triggerScenarios":"Listing workload templates (secrets of type workload template) without a principal in the request context, e.g. unauthenticated API calls or tests invoking the handler directly on a bare context.","commonSituations":"Calling the workloadtemplate API without a token; integration tests that construct restful.Request without running authn filters; proxies stripping credentials.","solutions":["Include a valid bearer token when listing workload templates.","In tests, wrap the request context with request.WithUser to supply a user.Info.","Confirm ks-apiserver's authentication filter chain handles the workloadtemplate routes.","Check token validity/expiry and re-login if needed."],"exampleFix":"// before (test)\nreq := restful.NewRequest(http.NewRequest(\"GET\", \"/workloadtemplates\", nil))\n// after\nctx := request.WithUser(r.Context(), &user.DefaultInfo{Name: \"admin\", Groups: []string{\"system\"}})\nr = r.WithContext(ctx)\nreq := restful.NewRequest(r)","handlingStrategy":"validation","validationCode":"// ensure user info exists before invoking handler in tests\nctx := request.WithUser(r.Context(), &user.DefaultInfo{Name: \"admin\"})\nr = r.WithContext(ctx)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Send valid credentials with workloadtemplate list calls","Seed user.Info in test contexts","Check middleware ordering after upgrading ks-apiserver"],"tags":["authentication","authorization","kubesphere"],"backgroundTag":"missing-auth-context","analyzedSha":"04a29b5c601470fa6bc2f2e92358dcb802a0d414","analyzedAt":"2026-09-03T18:33:15.017Z","contentChangedAt":"2026-09-03T18:33:15.017Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}