Add a feature flag for redirecting unknown-format requests

lib/gitlab/devise_failure.rb

@@ -5,6 +5,8 @@ module Gitlab
     # If the request format is not known, send a redirect instead of a 401
     # response, since this is the outcome we're most likely to want
     def http_auth?
+      return super unless Feature.enabled?(:devise_redirect_unknown_formats, default_enabled: true)
+
       request_format && super
     end
   end

spec/controllers/application_controller_spec.rb

@@ -191,10 +191,20 @@ describe ApplicationController do
       expect(response).to redirect_to new_user_session_path
     end
 
-    it 'redirects if unauthenticated and request format is unknown' do
-      get :index, format: 'unknown'
+    context 'request format is unknown' do
+      it 'redirects if unauthenticated' do
+        get :index, format: 'unknown'
 
-      expect(response).to redirect_to new_user_session_path
+        expect(response).to redirect_to new_user_session_path
+      end
+
+      it 'returns a 401 if the feature flag is disabled' do
+        stub_feature_flags(devise_redirect_unknown_formats: false)
+
+        get :index, format: 'unknown'
+
+        expect(response).to have_gitlab_http_status(401)
+      end
     end
   end