Re: Allowing anonymous access per default?

[Lars Trieloff]

If all you send is a 403, the user has no means of logging in. Browsers only display the login box if a 401 response has been received.

regards,

Lars



On 28.02.2008, at 14:44, David Nuescheler wrote:

If a user is properly logged in and his privileges do not allow to access a potion of content, 403 is the right response. But in the case of the anonymous user that has been logged in by default without ever giving the user the possibility to log-on, 401 would be the correct response. P.S. is there a way to override the automatic login of anonymous per configuration?

hi all,

here my +1 for anonymous access by default.

also prompting the user with a 401 for something that he does not

content there is no way to tell that something exists.

have read access for is not an option, since in jcr if you are able to read

But still, the desired behavior is to ask the user for authentication if

he is not authenticated and write permission is denied.

Your problem has nothing to do with the fact that we allow anonymous
access per default now.

there. Could you please open an issue?

Before that you could login as anonymous and would face the same problems. This is rather a problem of the post servlet and the permission checking

i agree with carstens assessment.


be a 403 error code instead. thoughts?

regards,
david

i don't think though that the desired respeonse code for a permission denied on the repository level is a 401 even for "anonymous", but i think it should

--
Lars Trieloff
[EMAIL PROTECTED]
http://weblogs.goshaky.com/weblogs/lars

smime.p7s
Description: S/MIME cryptographic signature