e1d2ecef10
500 status codes are for unexpected server-side error scenarios. When an expired nonce is used by the client, a 4XX-level error is more appropriate because the client has submitted a bad request (by using an expired nonce). A 500 also causes Internet Explorer to show its default 500 page which does not show the error message and leads to a bad end user experience. I am choosing 400 for the new status rather than 401 or 403 because 401 requires a WWW-Authenticate header which would be difficult to generate in an SSO scenario and a 403 implies that no re-authentication will address the failure. |
||
|---|---|---|
| .. | ||
| admin | ||
| users | ||
| about_controller.rb | ||
| application_controller.rb | ||
| badges_controller.rb | ||
| categories_controller.rb | ||
| clicks_controller.rb | ||
| composer_messages_controller.rb | ||
| directory_items_controller.rb | ||
| draft_controller.rb | ||
| email_controller.rb | ||
| embed_controller.rb | ||
| exceptions_controller.rb | ||
| export_csv_controller.rb | ||
| forums_controller.rb | ||
| groups_controller.rb | ||
| highlight_js_controller.rb | ||
| invites_controller.rb | ||
| list_controller.rb | ||
| notifications_controller.rb | ||
| onebox_controller.rb | ||
| permalinks_controller.rb | ||
| post_actions_controller.rb | ||
| posts_controller.rb | ||
| queued_posts_controller.rb | ||
| robots_txt_controller.rb | ||
| search_controller.rb | ||
| session_controller.rb | ||
| site_controller.rb | ||
| site_customizations_controller.rb | ||
| static_controller.rb | ||
| stylesheets_controller.rb | ||
| topics_controller.rb | ||
| uploads_controller.rb | ||
| user_actions_controller.rb | ||
| user_avatars_controller.rb | ||
| user_badges_controller.rb | ||
| users_controller.rb | ||