404 for all exceptions around auth?

Devan Goodwin dgoodwin at rm-rf.ca
Wed Aug 17 12:06:54 UTC 2011


On Wed, Aug 17, 2011 at 9:02 AM, Bryan Kearney <bkearney at redhat.com> wrote:
> On 08/16/2011 04:54 PM, jesus m. rodriguez wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> On 08/16/2011 04:22 PM, Bryan Kearney wrote:
>>> Anyone else?
>>>
>>> -- bk
>>>
>>> On 08/16/2011 10:37 AM, Bryan Kearney wrote:
>>>> On 08/16/2011 10:34 AM, Michael Stead wrote:
>>>>> On 08/16/2011 10:31 AM, Bryan Kearney wrote:
>>>>>> On 08/15/2011 05:33 PM, Bryan Kearney wrote:
>>>>>>> Devan:
>>>>>>>
>>>>>>> Take a look at the latest patch in [1]. It builds on the earlier patch.
>>>>>>> I would tend to vote that I do not like this patch, since it causes us
>>>>>>> to loose fidelity in why exceptions are failing in order to stop folks
>>>>>>> from fishing the app for owner ids. If I am in the minority, I am happy
>>>>>>> to push it in.
>>>>>>>
>>>>>>> Comments from other folks are appreciated.
>>>>>>>
>>>>>>
>>>>>> Bump
>>>>>>
>>>>>> -- bk
>>>>>>
>>>>>>
>>>>>> _______________________________________________
>>>>>> candlepin mailing list
>>>>>> candlepin at lists.fedorahosted.org
>>>>>> https://fedorahosted.org/mailman/listinfo/candlepin
>>>>>
>>>>> I've been thinking about this, and keep changing sides. :/
>>>>>
>>>>>  From a caller perspective, I think that I would like to know the reason
>>>>> an API call failed. Access Denied seems somewhat misleading if a
>>>>> resource was not found.
>>>>
>>>> Well, to be clear, the issue is with the new patch that the user would
>>>> get 404 (Not Found) because of a lack of permissions.
>>>>
>>>>>
>>>>> On the other hand, attempting to access a resource that doesn't exist is
>>>>> still really an Access Denied W.R.T the SecurityInterceptor, as it
>>>>> doesn't exist. And it does log the reason for denial...
>>>>>
>>>>> I think I would prefer to NOT push the patch.
>>>>
>>>> I think the issue with the original patch is that folks want to use 404
>>>> to horizontally scale candlepin servers.
>>>>
>>>> -- bk
>>>
>>> _______________________________________________
>>> candlepin mailing list
>>> candlepin at lists.fedorahosted.org
>>> https://fedorahosted.org/mailman/listinfo/candlepin
>>
>>
>> Sorry wasn't paying a lot of attention to this thread. In general I prefer
>> 404 for things that do not exist. And a 403 if you do not have access
>> to them.
>>
>> I realize this means that if you have access to cp i.e. valid login,
>> you could start asking for owners at random getting 404 for those that
>> don't exist and 403 for those that do exist but you don't have access
>> to.
>>
>> Forbidden (403) is definitely more explicit, because then I can inquire
>> about getting said permissions vs trying to create a new one if it were
>> a 404.
>>
>> jesus
>>
>
> Devan:
>
> Are you ok with the first patch, not he second? That fixes the
> horizontal scaling.. but keeps the 403 information flow.
>
> -- bk

http://jbowes.fedorapeople.org/albatross.jpg



More information about the candlepin mailing list