Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Clarify 401 vs. 403 #105

Merged
merged 1 commit into from Nov 17, 2015
Merged

Clarify 401 vs. 403 #105

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
10 changes: 5 additions & 5 deletions source.txt
View file
Open in desktop
Expand Up @@ -281,11 +281,11 @@ Table of Contents
* 414 if the request URI is too long,
* 416 if Range requests are supported by the server and the Range
request can not be satisfied,
* 401 for all requests that don't have a bearer token with
sufficient permissions,
* 403 for all requests that either have insufficient scope, e.g.
accessing a <module> for which no scope was obtained, or accessing
data outside the user's <storage_root>,
* 401 for all requests that require a valid bearer token and
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I still don't understand what "valid" is supposed to mean in this context. Syntactic validity might e.g. only mean that some value that fits the ABNF was sent. I couldn't find anything about valid tokens in the OAuth RFC.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It was [BEARER], not [OAUTH], sorry (it's also already mentioned at the start of the section).

where no valid one was sent (see also [BEARER, section 3.1]),
* 403 for all requests that have insufficient scope, e.g.
accessing a <module> for which no scope was obtained, or
accessing data outside the user's <storage_root>,
* 404 for all DELETE and GET requests to documents that do not
exist on the storage,
* 304 for a conditional GET request whose pre-condition
Expand Down