404 for all exceptions around auth?
Michael Stead
mstead at redhat.com
Tue Aug 16 14:34:51 UTC 2011
On 08/16/2011 10:31 AM, Bryan Kearney wrote:
> On 08/15/2011 05:33 PM, Bryan Kearney wrote:
>> Devan:
>>
>> Take a look at the latest patch in [1]. It builds on the earlier patch.
>> I would tend to vote that I do not like this patch, since it causes us
>> to loose fidelity in why exceptions are failing in order to stop folks
>> from fishing the app for owner ids. If I am in the minority, I am happy
>> to push it in.
>>
>> Comments from other folks are appreciated.
>>
>
> Bump
>
> -- bk
>
>
> _______________________________________________
> candlepin mailing list
> candlepin at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/candlepin
I've been thinking about this, and keep changing sides. :/
From a caller perspective, I think that I would like to know the reason
an API call failed. Access Denied seems somewhat misleading if a
resource was not found.
On the other hand, attempting to access a resource that doesn't exist is
still really an Access Denied W.R.T the SecurityInterceptor, as it
doesn't exist. And it does log the reason for denial...
I think I would prefer to NOT push the patch.
--mstead
More information about the candlepin
mailing list