MCM-38 — Unauthorized Access Fails Closed
Unauthenticated or invalid requests to mcm-docs always redirect or fail clearly, never leak content or show a broken page.
MCM-38 — Unauthorized Access Fails Closed
← Back to Internal Docs Single Sign-On overview
As a Platform Admin,
I want every unauthenticated or invalid request to mcm-docs to fail clearly rather than leak content or show a broken page,
so that there's no accidental content exposure and the failure mode is unambiguous.
Acceptance Criteria
- An invalid or expired session results in a fresh login redirect, not an error page.
- Requesting an individual asset (e.g. an image) directly, without a session, also fails closed — assets are covered by the same check as pages, not just the top-level page routes.
- There is no path to any mcm-docs content that skips the session check, including assets and non-page resources.
Technical Design
The same session check that gates page requests (see MCM-37) applies uniformly to every request the gateway routes to mcm-docs, not just top-level page loads — an image, script, or other asset request without a valid session is treated identically to a page request without one. An invalid or expired session is treated the same as no session at all: a redirect to login, never a raw error page.
UI / Frontend Changes
- No new screens — the outcome is either the requested page (valid session) or the login redirect (no valid session), with no intermediate broken-page state ever shown.