Changes between Version 37 and Version 38 of S3/S3AAA

Timestamp:

01/18/11 00:58:57 (12 years ago)

Author:

Dominic König

Comment:

--

S3/S3AAA

@@ -185 +185 @@
 === Handling Insufficient Permissions ===
 
-In case the user has insufficient permissions to access a table/record with the requested method, a well-defined response action must take place:
-
-  - in '''interactive''' formats:
+In case the user has insufficient permissions to access a table/record with the requested method, a well-defined response action must take place depending on the request format:
+
+  - in '''HTML''' format:
     - already authenticated users should be informed about the insufficient permissions, and redirected to a (unrestricted) landing page
     - unauthenticated users should be requested to login, and forwarded to a login page
-  - in '''non-interactive''' formats:
+  - in '''all other''' formats:
     - authenticated clients must receive a HTTP 403 (Forbidden) error code to cancel the request properly
     - unauthenticated clients must receive a HTTP 401 (Authorization Required) error in order to trigger an authentication attempt
+    - the client must not be redirected in either of the cases (important!)
 
 All this is covered by the {{{auth.permission.fail()}}} method:
@@ -202 +203 @@
 }}}
 
-For interactive modes, you can alter the destinations for redirection by setting:
+You can alter the destinations for redirection by setting:
 
   - {{{auth.permission.homepage}}} for redirection when the user is logged-in, but has insufficient privileges (defaults to {{{default/index}}}).