BartOtten

BartOtten

Should phx.gen.auth return 401s

This code assumes that get_organization_by_slug!/2 raises anEcto.NoResultsError which would be automatically converted to 404 , but you could also handle the error explicitly and, for example, set an error flash and redirect to another page, like a dashboard.

The get_organization_by_slug!/2 function should also rely on the current scope to filter the organizations to those the user has access to.

Would love for Phoenix to ship with “Login to gain access” screen. This is quite common and a far better UX than throwing a 404.

Also having no result due to scope should throw a
401 Unauthorized imho.

Although the HTTP standard specifies “unauthorized”, semantically this response means “unauthenticated”. That is, the client must authenticate itself to get the requested response

Or (when a user or org is known but no access)
403 Forbidden

The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401 Unauthorized, the client’s identity is known to the server

Having these available and correct would help developers doing “the right thing”.

Most Liked

josevalim

josevalim

Creator of Elixir

Most of the release for v1.8 was exactly in trimming down what we generate because it was clear that it was generating too much, getting in the way of both experienced devs (generating stuff they didn’t want) and new ones (too much to grasp at once). So there is a clear trend we are aiming for when it comes to generated code.

It is already exhausting to be in the forums and getting to constantly hear about everyone’s wish list. And on top of that, getting eye rolls, called weird (another thread) and unfair. When maintainers get characterized negatively for making decisions aligned with project goals or when simply sharing their opinion, it makes it harder to justify spending time in these informal discussions. So overall it is probably best for me to keep some distance and not get involved unless through official proposals.

LostKobrakai

LostKobrakai

There’s a security aspect to this between 404 and 401. 401 does acknowledge the existance of a record with the provided id, which might already be interesting information to a bad actor.

BartOtten

BartOtten

The 404 (Not Found) status code indicates that the origin server did not find a current representation for the target resource or is not willing to disclose that one exists.

Should read RFC updates at breakfast. Settles it: 404 is okey. Also “current representation” :sweat_smile:

Last Post!

BartOtten

BartOtten

Answer to the question: no, 404 is fine.

Case closed.

Where Next?

Popular in Discussions Top

ricklove
I was just introduced to Elixir and Phoenix. I was told about the 2 million websocket test that was done 2 years ago. From my research, t...
New
rower687
Hi all, I’ve been reading a lot about the “let it crash” term and how supervising processes and the whole messaging passing make an elixi...
New
Nvim
Elixir appears to be a superior language to Python. I don’t see any advantage of Python over Elixir. Are there any?
New
klo
Got a question about when to concat vs. prepending items to list then reversing to achieve appending. So i know lists boil down to [1 | ...
New
AstonJ
Can you believe the first professionally published Elixir book was published just 8 years ago? Since then I think we’ve seen more books f...
New
paulanthonywilson
I like Umbrella projects and pretty much always use them for personal Elixir stuff, especially Nerves things. But I don’t think this is ...
New
sergio
Kind of like when jquery came out, it was super necessary. Existing drag and drop libraries have a bunch of baggage to support old browse...
New

Other popular topics Top

baxterw3b
Hi guys, i’m new in the Elixir world, and i have to say, that i love it! i’m having some problem to understand anonymous functions with ...
New
Qqwy
Original source of discussion: This topic on the Pragmatic Programmers’ Functional Web Development with Elixir, OTP, and Phoenix forum. ...
New
jononomo
For some reason my phoenix channels are working for me in my local dev environment, but as soon as I deploy via Docker, I get a 403 error...
New
chrismccord
Phoenix 1.4.0 released Phoenix 1.4 is out! This release ships with exciting new features, most notably with HTTP2 support, improved deve...
688 31586 112
New
axelson
This post is a wiki (feel free to hit the edit button near the bottom right of this post to add your own changes!) This post collects co...
239 49266 226
New
AngeloChecked
What learn first? Rust or Elixir Hi Elixir community! I’m here because i want learn a new language. I’m a junior developer and mainly i ...
New

We're in Beta

About us Mission Statement