From 16b717022b56559f0dfbb258b8d69dd8cbf8b37b Mon Sep 17 00:00:00 2001
From: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Date: Mon, 2 May 2016 19:37:47 -0400
Subject: [PATCH 1/2] In a list response, if there are no keys, 404 to be
 consistent with GET and with different backend conditions

Fixes #1365
---
 http/logical.go | 31 ++++++++++++++++++++++++++++---
 1 file changed, 28 insertions(+), 3 deletions(-)

diff --git a/http/logical.go b/http/logical.go
index 2502ec1f9..02cb1d8a0 100644
--- a/http/logical.go
+++ b/http/logical.go
@@ -92,9 +92,34 @@ func handleLogical(core *vault.Core, dataOnly bool, prepareRequestCallback Prepa
 		if !ok {
 			return
 		}
-		if (op == logical.ReadOperation || op == logical.ListOperation) && resp == nil {
-			respondError(w, http.StatusNotFound, nil)
-			return
+		switch {
+		case op == logical.ReadOperation:
+			if resp == nil {
+				respondError(w, http.StatusNotFound, nil)
+				return
+			}
+
+		// Basically: if we have empty "keys" or no keys at all, 404. This
+		// provides consistency with GET.
+		case op == logical.ListOperation:
+			if resp == nil || len(resp.Data) == 0 {
+				respondError(w, http.StatusNotFound, nil)
+				return
+			}
+			keysInt, ok := resp.Data["keys"]
+			if !ok {
+				respondError(w, http.StatusNotFound, nil)
+				return
+			}
+			keys, ok := keysInt.([]string)
+			if !ok {
+				respondError(w, http.StatusNotFound, nil)
+				return
+			}
+			if len(keys) == 0 {
+				respondError(w, http.StatusNotFound, nil)
+				return
+			}
 		}
 
 		// Build the proper response

From 7e462e566bb20d6bb7035046e947201194121d4f Mon Sep 17 00:00:00 2001
From: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Date: Mon, 2 May 2016 20:00:46 -0400
Subject: [PATCH 2/2] Check nil keys and respond internal error if it can't be
 cast to a []string

---
 http/logical.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/http/logical.go b/http/logical.go
index 02cb1d8a0..b6f7fddab 100644
--- a/http/logical.go
+++ b/http/logical.go
@@ -107,13 +107,13 @@ func handleLogical(core *vault.Core, dataOnly bool, prepareRequestCallback Prepa
 				return
 			}
 			keysInt, ok := resp.Data["keys"]
-			if !ok {
+			if !ok || keysInt == nil {
 				respondError(w, http.StatusNotFound, nil)
 				return
 			}
 			keys, ok := keysInt.([]string)
 			if !ok {
-				respondError(w, http.StatusNotFound, nil)
+				respondError(w, http.StatusInternalServerError, nil)
 				return
 			}
 			if len(keys) == 0 {