BartOtten
Should phx.gen.auth return 401s
This code assumes that
get_organization_by_slug!/2raises anEcto.NoResultsErrorwhich would be automatically converted to404, but you could also handle the error explicitly and, for example, set an error flash and redirect to another page, like a dashboard.The
get_organization_by_slug!/2function should also rely on the current scope to filter the organizations to those the user has access to.
Would love for Phoenix to ship with “Login to gain access” screen. This is quite common and a far better UX than throwing a 404.
Also having no result due to scope should throw a
401 Unauthorized imho.
Although the HTTP standard specifies “unauthorized”, semantically this response means “unauthenticated”. That is, the client must authenticate itself to get the requested response
Or (when a user or org is known but no access)
403 Forbidden
The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike
401 Unauthorized, the client’s identity is known to the server
Having these available and correct would help developers doing “the right thing”.
Most Liked
josevalim
Most of the release for v1.8 was exactly in trimming down what we generate because it was clear that it was generating too much, getting in the way of both experienced devs (generating stuff they didn’t want) and new ones (too much to grasp at once). So there is a clear trend we are aiming for when it comes to generated code.
It is already exhausting to be in the forums and getting to constantly hear about everyone’s wish list. And on top of that, getting eye rolls, called weird (another thread) and unfair. When maintainers get characterized negatively for making decisions aligned with project goals or when simply sharing their opinion, it makes it harder to justify spending time in these informal discussions. So overall it is probably best for me to keep some distance and not get involved unless through official proposals.
LostKobrakai
There’s a security aspect to this between 404 and 401. 401 does acknowledge the existance of a record with the provided id, which might already be interesting information to a bad actor.
BartOtten
The 404 (Not Found) status code indicates that the origin server did not find a current representation for the target resource or is not willing to disclose that one exists.
Should read RFC updates at breakfast. Settles it: 404 is okey. Also “current representation” ![]()
Last Post!
BartOtten
Popular in Discussions
Other popular topics
Latest Phoenix Threads
Chat & Discussions>Discussions
Latest on Elixir Forum
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #elixirconf-us
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #security
- #hex









