Subject: Ticket #294, was: 403 description clarifications

From: Julian Reschke <[email-masked]>
Date: Wed, 25 May 2011 10:07:10 +0200

On 2010-09-29 03:45, Thomson, Martin wrote:
> I've had a question about 403 from an engineer here, and I think that it's a valid one.  The semantics of this header are well understood, but the actual text doesn't match that understanding.
>
> See: http://lists.w3.org/Archives/Public/ietf-http-wg/2010JulSep/0085.html

Indeed. We hadn't been tracking this. Sorry.

Now added as <http://trac.tools.ietf.org/wg/httpbis/trac/ticket/294>.

> Specifically, this point:
>
>> 403 ->  this is forbidden for you, but authenticating as somebody else may help
>
> When compared with this sentence, from [1]:
>
>     Authorization will not help and the request SHOULD NOT be repeated.
>
> This sentence appears to be false [2] for the bulk of the cases where this status code is used.  If the user was authorized, then it really would help.
>
> I think that this is the actual intent:
>
>    The server understood the request, but refuses to authorize it.  Providing different user authentication credentials might be successful, but any credentials that were provided in the request are insufficient.

Sounds good to me.

> I also have a small editorial nit: The other text here about providing feedback is a separate concept and can be given a separate paragraph:
>
>    A server can [MAY?] instead provided a 404 (Not Found) status code to prevent clients from learning of the existence of the resource.  Alternatively, a server can provide a representation containing the reasons that the request was not fulfilled if this information can be made public.
 > ...

Indeed.

And yes, this sounds like a case where we want to shift from "can" to "MAY".

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Wed, 25 May 2011 15:44:56 +0200

Proposed patch: 
<http://trac.tools.ietf.org/wg/httpbis/trac/attachment/ticket/294/i294.diff>

This makes the definition of 403 read:

8.4.4.  403 Forbidden

    The server understood the request, but refuses to authorize it.
    Providing different user authentication credentials might be
    successful, but any credentials that were provided in the request are
    insufficient.  The request SHOULD NOT be repeated with the same
    credentials.

    If the request method was not HEAD and the server wishes to make
    public why the request has not been fulfilled, it SHOULD describe the
    reason for the refusal in the representation.  If the server does not
    wish to make this information available to the client, the status
    code 404 (Not Found) MAY be used instead.

Feedback appreciated, Julian

---

From: Julian Reschke <[email-masked]>
Date: Fri, 27 May 2011 12:58:17 +0200

> code 404 (Not Found) MAY be used instead.

...applied with <http://trac.tools.ietf.org/wg/httpbis/trac/changeset/1301>.

Best regards, Julian