404 for all exceptions around auth?

Bryan Kearney bkearney at redhat.com
Tue Aug 16 20:22:07 UTC 2011


Anyone else?

-- bk

On 08/16/2011 10:37 AM, Bryan Kearney wrote:
> On 08/16/2011 10:34 AM, Michael Stead wrote:
>> On 08/16/2011 10:31 AM, Bryan Kearney wrote:
>>> On 08/15/2011 05:33 PM, Bryan Kearney wrote:
>>>> Devan:
>>>>
>>>> Take a look at the latest patch in [1]. It builds on the earlier patch.
>>>> I would tend to vote that I do not like this patch, since it causes us
>>>> to loose fidelity in why exceptions are failing in order to stop folks
>>>> from fishing the app for owner ids. If I am in the minority, I am happy
>>>> to push it in.
>>>>
>>>> Comments from other folks are appreciated.
>>>>
>>>
>>> Bump
>>>
>>> -- bk
>>>
>>>
>>> _______________________________________________
>>> candlepin mailing list
>>> candlepin at lists.fedorahosted.org
>>> https://fedorahosted.org/mailman/listinfo/candlepin
>>
>> I've been thinking about this, and keep changing sides. :/
>>
>> From a caller perspective, I think that I would like to know the reason
>> an API call failed. Access Denied seems somewhat misleading if a
>> resource was not found.
>
> Well, to be clear, the issue is with the new patch that the user would
> get 404 (Not Found) because of a lack of permissions.
>
>>
>> On the other hand, attempting to access a resource that doesn't exist is
>> still really an Access Denied W.R.T the SecurityInterceptor, as it
>> doesn't exist. And it does log the reason for denial...
>>
>> I think I would prefer to NOT push the patch.
>
> I think the issue with the original patch is that folks want to use 404
> to horizontally scale candlepin servers.
>
> -- bk




More information about the candlepin mailing list