404 for all exceptions around auth?

Michael Stead mstead at redhat.com
Tue Aug 16 14:34:51 UTC 2011


On 08/16/2011 10:31 AM, Bryan Kearney wrote:
> On 08/15/2011 05:33 PM, Bryan Kearney wrote:
>> Devan:
>>
>> Take a look at the latest patch in [1]. It builds on the earlier patch.
>> I would tend to vote that I do not like this patch, since it causes us
>> to loose fidelity in why exceptions are failing in order to stop folks
>> from fishing the app for owner ids. If I am in the minority, I am happy
>> to push it in.
>>
>> Comments from other folks are appreciated.
>>
>
> Bump
>
> -- bk
>
>
> _______________________________________________
> candlepin mailing list
> candlepin at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/candlepin

I've been thinking about this, and keep changing sides. :/

 From a caller perspective, I think that I would like to know the reason 
an API call failed. Access Denied seems somewhat misleading if a 
resource was not found.

On the other hand, attempting to access a resource that doesn't exist is 
still really an Access Denied W.R.T the SecurityInterceptor, as it 
doesn't exist. And it does log the reason for denial...

I think I would prefer to NOT push the patch.

--mstead






More information about the candlepin mailing list