Open Stack

On Tue, 2015-05-05 at 21:30 +0200, Chen CH Ji wrote:
> In doing patch [1], A suggestion is submitted that we should return
> 400 (bad Request) instead of 403 (Forbidden)
> I take a look at [2], seems 400 is not a good candidate because 
> 'The request could not be understood by the server due to malformed
> syntax. The client SHOULD NOT repeat the request without
> modifications. '
> 
> may be a 409 (conflict) error if we really don't think 403 is a good
> one? 
> Thanks
> 
> 
> [1] https://review.openstack.org/#/c/173985/
> [2] http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html

Looking through the HTTP spec you reference in [2], there isn't really a
good match.  You're right that 400 doesn't really make sense, but I
don't really think that 409 is a good fit either.  The only ones that
would make sense to me would be 413 ("Request Entity Too Large") and
403, the definition of which is wide enough to encompass the over-quota
condition; and of those, 403 makes the most sense.  (Note that I believe
we use 413 for rate limiting, because of the Retry-After header…)
-- 
Kevin L. Mitchell <kevin.mitchell at rackspace.com>
Rackspace