[Beaker-devel] BZ# 998354: Docs for writing flask controllers
Dan Callaghan
dcallagh at redhat.com
Tue Sep 17 02:45:18 UTC 2013
Excerpts from Amit Saha's message of 2013-09-17 12:05:50 +1000:
> UI Feedback: Although Flask has it's own mechanism for flash messages,
> you must use Turbogears's flash() method
I don't think TG's flash works outside of TurboGears so don't use that
either. My recommendation is "don't use flash at all, design the UI
better" but that's not a particularly helpful or concrete recommendation
so can we just leave this out for now?
> Aborting: If something is not right, use the abort() function
> to raise a HTTPException. For eg, abort(401) would indicate a
> authentication failure.
>
> To learn more: http://flask.pocoo.org/docs/api/#flask.abort
abort(401) is a bad example because it creates a response that violates
the spec... 401 is supposed to include an WWW-Authenticate header
telling the client how it may authenticate, but we can't do that because
the way to authenticate is using the /login form, not any standard HTTP
mechanism. This is a weakness in our entire approach to authentication
(as inherited from TG) but there is nothing much better we can do in
those particular examples since they are called by a widget in the UI
which can't handle a 302 to /login correctly.
So for a general example of abort(), abort(403) is a good one, meaning
the user is authenticated but they don't have access.
--
Dan Callaghan <dcallagh at redhat.com>
Software Engineer, Infrastructure Engineering and Development
Red Hat, Inc.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/beaker-devel/attachments/20130917/e0b3b737/attachment.sig>
More information about the Beaker-devel
mailing list