----- Original Message -----
From: "Dan Callaghan" <dcallagh(a)redhat.com>
To: "beaker-devel" <beaker-devel(a)lists.fedorahosted.org>
Sent: Tuesday, September 17, 2013 12:45:18 PM
Subject: Re: [Beaker-devel] BZ# 998354: Docs for writing flask controllers
Excerpts from Amit Saha's message of 2013-09-17 12:05:50 +1000:
> UI Feedback: Although Flask has it's own mechanism for flash messages,
> you must use Turbogears's flash() method
I don't think TG's flash works outside of TurboGears so don't use that
either. My recommendation is "don't use flash at all, design the UI
better" but that's not a particularly helpful or concrete recommendation
so can we just leave this out for now?
Sure, if it something we don't want to encourage, that sounds fair.
> Aborting: If something is not right, use the abort() function
> to raise a HTTPException. For eg, abort(401) would indicate a
> authentication failure.
>
> To learn more:
http://flask.pocoo.org/docs/api/#flask.abort
abort(401) is a bad example because it creates a response that violates
the spec... 401 is supposed to include an WWW-Authenticate header
telling the client how it may authenticate, but we can't do that because
the way to authenticate is using the /login form, not any standard HTTP
mechanism. This is a weakness in our entire approach to authentication
(as inherited from TG) but there is nothing much better we can do in
those particular examples since they are called by a widget in the UI
which can't handle a 302 to /login correctly.
So for a general example of abort(), abort(403) is a good one, meaning
the user is authenticated but they don't have access.
Okay.
Thanks,
Amit.
--
Amit Saha <
http://echorand.me>
Infrastructure Engineering and Development
Red Hat, Inc.