[Beaker-devel] BZ# 998354: Docs for writing flask controllers

Amit Saha asaha at redhat.com
Tue Sep 17 03:01:13 UTC 2013



----- Original Message -----
> From: "Dan Callaghan" <dcallagh at redhat.com>
> To: "beaker-devel" <beaker-devel at lists.fedorahosted.org>
> Sent: Tuesday, September 17, 2013 12:45:18 PM
> Subject: Re: [Beaker-devel] BZ# 998354: Docs for writing flask controllers
> 
> Excerpts from Amit Saha's message of 2013-09-17 12:05:50 +1000:
> > UI Feedback: Although Flask has it's own mechanism for flash messages,
> > you must use Turbogears's flash() method
> 
> I don't think TG's flash works outside of TurboGears so don't use that
> either. My recommendation is "don't use flash at all, design the UI
> better" but that's not a particularly helpful or concrete recommendation
> so can we just leave this out for now?

Sure, if it something we don't want to encourage, that sounds fair.

> 
> > Aborting: If something is not right, use the abort() function
> > to raise a HTTPException. For eg, abort(401) would indicate a
> > authentication failure.
> > 
> > To learn more: http://flask.pocoo.org/docs/api/#flask.abort
> 
> abort(401) is a bad example because it creates a response that violates
> the spec... 401 is supposed to include an WWW-Authenticate header
> telling the client how it may authenticate, but we can't do that because
> the way to authenticate is using the /login form, not any standard HTTP
> mechanism. This is a weakness in our entire approach to authentication
> (as inherited from TG) but there is nothing much better we can do in
> those particular examples since they are called by a widget in the UI
> which can't handle a 302 to /login correctly.
> 
> So for a general example of abort(), abort(403) is a good one, meaning
> the user is authenticated but they don't have access.

Okay.

Thanks,
Amit.

-- 
Amit Saha <http://echorand.me>
Infrastructure Engineering and Development
Red Hat, Inc.


More information about the Beaker-devel mailing list