[Beaker-devel] BZ# 998354: Docs for writing flask controllers

Dan Callaghan dcallagh at redhat.com
Tue Sep 17 02:45:18 UTC 2013


Excerpts from Amit Saha's message of 2013-09-17 12:05:50 +1000:
> UI Feedback: Although Flask has it's own mechanism for flash messages,
> you must use Turbogears's flash() method

I don't think TG's flash works outside of TurboGears so don't use that 
either. My recommendation is "don't use flash at all, design the UI 
better" but that's not a particularly helpful or concrete recommendation 
so can we just leave this out for now?

> Aborting: If something is not right, use the abort() function
> to raise a HTTPException. For eg, abort(401) would indicate a 
> authentication failure.
> 
> To learn more: http://flask.pocoo.org/docs/api/#flask.abort

abort(401) is a bad example because it creates a response that violates 
the spec... 401 is supposed to include an WWW-Authenticate header 
telling the client how it may authenticate, but we can't do that because 
the way to authenticate is using the /login form, not any standard HTTP 
mechanism. This is a weakness in our entire approach to authentication 
(as inherited from TG) but there is nothing much better we can do in 
those particular examples since they are called by a widget in the UI 
which can't handle a 302 to /login correctly.

So for a general example of abort(), abort(403) is a good one, meaning 
the user is authenticated but they don't have access.

-- 
Dan Callaghan <dcallagh at redhat.com>
Software Engineer, Infrastructure Engineering and Development
Red Hat, Inc.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/beaker-devel/attachments/20130917/e0b3b737/attachment.sig>


More information about the Beaker-devel mailing list