Skip to content

Commit

Permalink
add info on 403 response code
Browse files Browse the repository at this point in the history
  • Loading branch information
François Kooman committed Oct 7, 2015
1 parent d53a858 commit c682944
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions source.txt
View file
Expand Up @@ -283,6 +283,9 @@ Table of Contents
request can not be satisfied,
* 401 for all requests that don't have a bearer token with
sufficient permissions,
* 403 for all requests that either have insufficient scope, e.g.
accessing a <module> for which no scope was obtained, or accessing
data outside the user's <storage_root>,
* 404 for all DELETE and GET requests to documents that do not
exist on the storage,
* 304 for a conditional GET request whose pre-condition
Expand Down

4 comments on commit c682944

@michielbdejong
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey, after reading https://en.wikipedia.org/wiki/List_of_HTTP_status_codes#4xx_Client_Error I'm not actually sure if this is correct. 'insufficient scope' should definitely be 401. I'll create a PR to make this clearer.

@michielbdejong
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, so seems that OAuth 2.0 contradicts HTTP 1.1 there! :) https://tools.ietf.org/html/rfc7235#section-3.1

@michielbdejong
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correction, it contradicts RFC2616, but that has been deprecated now.

Latest HTTP RFC text on 401s: http://tools.ietf.org/html/rfc7235#section-3.1

If the request included authentication credentials, then the 401
response indicates that authorization has been refused for those
credentials.

Latest HTTP RFC text on 403s: http://tools.ietf.org/html/rfc7231#section-6.5.3

If authentication credentials were provided in the request, the
server considers them insufficient to grant access.
The client MAY repeat the request with new or different
credentials. However, a request might be forbidden for reasons
unrelated to the credentials.

So the "Authorization will not help" text from http://tools.ietf.org/html/rfc2616#section-10.4.4 is no longer true for 403s.

@raucao
Copy link
Member

@raucao raucao commented on c682944 Nov 6, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So that means everything is correct in RS now. :)

Please sign in to comment.