Re: More detailed error message for 403 forbidden.

From: Jeff King <peff@peff.net>
Date: Mar 28, 2013, 20:18 UTC
Message-ID: <20130328201826.GA24103@sigill.intra.peff.net>
In-Reply-To: <7vk3ortk3o.fsf@alter.siamese.dyndns.org>

On Thu, Mar 28, 2013 at 12:11:55PM -0700, Junio C Hamano wrote:

Show 20 quoted lines

> Jeff King <peff@peff.net> writes:
> 
> > One problem is that the content body sent along with the error is not
> > necessarily appropriate for showing to the user (e.g., if it is HTML, it
> > is probably not a good idea to show it on the terminal). So I think we
> > would want to only show it when the server has indicated via the
> > content-type that the message is meant to be shown to the user. I'm
> > thinking the server would generate something like:
> >
> >    HTTP/1.1 403 Forbidden
> >    Content-type: application/x-git-error-message
> >
> >    User 'me' does not have enough permission to access the repository.
> >
> > which would produce the example you showed above.
> 
> Actually, isn't the human-readable part of the server response meant
> for this kind of thing?  I.e.
> 
> 	HTTP/1.1 403 User 'me' not allowed to accept the repository.

In theory, yes. But I don't think that most servers make it very easy to use custom "reason phrases" (that is the rfc 2616 term for them). At least I could not easily figure out how to make Apache do so. You can do so from CGIs, but I think you'd want to customize some of this at the HTTP server level (e.g., overriding 404s with a custom message). There's much better support at that level for custom error documents (e.g., Apache's ErrorDocument).

I do not configure http servers very often, though, so I could be wrong about what is normal practice, and what is easy to do.

-Peff