<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 03/11/2014 11:42 AM, Sudipta Biswas3
wrote:<br>
</div>
<blockquote
cite="mid:OFA105DD8E.21E01554-ON65257C98.0053BC38-65257C98.00568F66@in.ibm.com"
type="cite"><tt><font size="2">Hi all,</font></tt>
<br>
<br>
<tt><font size="2">I'm hitting a scenario where, a user runs an
action
against an object in neutron for which they don't have the
authority to
perform the action(perhaps their role allows read of the
object, but not
update). The following returned to back to the user when such
an action
is performed: "The resource could not be found". This can
be confusing to users. For example, basic users may not have
the
privilege to edit a network and attempts doing that but ends
up getting
the resource not found message, even though they have read
privileges.</font></tt>
<br>
<br>
<tt><font size="2">This is a confusing message because the object
they
just read in is now stating that it does not exist. This is
not true, the
root issue is that they do not have authority to it. One can
argue that
for security reasons, we should state that the object does not
exist. However,
it creates a odd scenario where you have certain roles that
can read an
object, but then not create/update/delete it. </font></tt>
<br>
<br>
<tt><font size="2">I have filed a community bug for the same: </font></tt><a
moz-do-not-send="true"
href="https://bugs.launchpad.net/neutron/+bug/1290895"><tt><font
size="2">https://bugs.launchpad.net/neutron/+bug/1290895</font></tt></a>
<br>
<br>
<tt><font size="2">I'm proposing that we change the message to
"The
resource could not be found or user's role does not have
sufficient privileges
to run the operation."</font></tt>
<br>
</blockquote>
Ther is a serious security concern with people probing for
information that they do not have access too. The 404 is a way to
make it impossible to distinguish between "the object does not
exist" and "it exists but it does not belong to you."<br>
<br>
<br>
<blockquote
cite="mid:OFA105DD8E.21E01554-ON65257C98.0053BC38-65257C98.00568F66@in.ibm.com"
type="cite">
<br>
<tt><font size="2">I'm sending to the mailing list to see if there
are
any discussion points against making this change.</font></tt>
<br>
<br>
<tt><font size="2">Thanks,</font></tt>
<br>
<tt><font size="2">Sudipto</font></tt>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
OpenStack-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a>
</pre>
</blockquote>
<br>
</body>
</html>