Subject: Re: #487 Resubmission of 403

From: "Roy T. Fielding" <[email-masked]>
Date: Mon, 1 Jul 2013 10:36:22 -0700

On Jun 30, 2013, at 9:17 AM, Julian Reschke wrote:

> On 2013-06-20 17:54, Julian Reschke wrote:
>> From the ticket:
>> 
>>> See comments in linked blog post; change
>>> 
>>> "The client should not repeat the request with the same credentials."
>>> 
>>> to
>>> 
>>> "The client should not automatically repeat the request with the same
>>> credentials."
>>> 
>>> Since some flows using 403 may involve manipulating state somewhere
>>> else, then resubmitting the request.
>> 
>> ...where the blog post is:
>> <http://www.mnot.net/blog/2013/05/15/http_problem>
>> 
>> The current text is:
>> 
>> "The 403 (Forbidden) status code indicates that the server understood
>> the request but refuses to authorize it. A server that wishes to make
>> public why the request has been forbidden can describe that reason in
>> the response payload (if any).
>> 
>> If authentication credentials were provided in the request, the server
>> considers them insufficient to grant access. The client SHOULD NOT
>> repeat the request with the same credentials. The client MAY repeat the
>> request with new or different credentials. However, a request might be
>> forbidden for reasons unrelated to the credentials.
>> 
>> An origin server that wishes to "hide" the current existence of a
>> forbidden target resource MAY instead respond with a status code of 404
>> (Not Found)." --
>> <http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p2-semantics-latest.html#status.403>
>> 
>> 
>> It seems there's a bigger problem here:
>> 
>> "If authentication credentials were provided in the request, the server
>> considers them insufficient to grant access."
>> 
>> This implies that *if* credentials have been provided, and the result is
>> 403, it's due to the credentials.

No, it does not.  Such a conclusion is not supportable by logic or
English, and certainly not in programming languages, so I see no
reason for a change here.  Read the entire paragraph.

>> ...
> 
> Here's an attempt of rewriting the second paragraph:
> 
> "Insufficient credentials can be a reason for refusing the request. In this case, the client SHOULD NOT repeat the request with the same credentials. However, a request might be forbidden for reasons unrelated to the credentials, and therefore the client has no reliable way to detect this situation."

No, that is just making a mountain out of a molehill.
403 means forbidden.  One reason for forbidding is that the
credentials provided are for a user that is forbidden.  The
correct way to state that is as written in the spec -- the
credentials are insufficient to gain access.  That does not
mean the credentials caused the 403; it means they were not
sufficient to overcome the 403.  A client is fully capable of
detecting whether it sent credentials and either using a
different set (if possible) or halting accordingly. It is
not the client's job to "detect" why the 403 is received.

....Roy

---

From: Julian Reschke <[email-masked]>
Date: Mon, 01 Jul 2013 22:09:18 +0200

> reason for a change here.  Read the entire paragraph.

I did, and I still think it's misleading. Again:

forbidden for reasons unrelated to the credentials."

So how does the client find out whether the credentials or something 
else caused the problem? In the first case, we say it SHOULD NOT repeat 
the request with the same credentials, in the second case we leave it 
somehow open.

Best regards, Julian

---

From: "Adrien W. de Croy" <[email-masked]>
Date: Mon, 01 Jul 2013 23:20:42 +0000

------ Original Message ------
From: "Julian Reschke" <[email-masked]>
To: "Roy T. Fielding" <[email-masked]>
Cc: "HTTP Working Group" <[email-masked]>
Sent: 2/07/2013 8:09:18 a.m.
Subject: Re: #487 Resubmission of 403
>I did, and I still think it's misleading. Again:
If it helps, the way I read it is that the clause doesn't try to provide 
any insight into how the client may determine if the problem is a 
credential one or not, except by referring to the payload of the 403.

* since it's a 403, the server wasn't prepared to grant access
* if it had creds, and yet still got a 403 response, therefore the creds 
were not enough to change the server's mind
* therefore the client shouldn't just try reusing the same creds, since 
they were insufficient
* the client has the option to try with different creds
* even new creds may not work, since it may not even be a credential 
issue
The "new or different" is a bit of a distraction IMO.  New = different.  
So it should just be

"The client MAY repeat the request with different credentials"

Adrien