Hello! The fix is in trunk (upcoming 6th beta) since last week.
This is handled by the repoze.what-pylons package, and the functionality that handles failed authorization particularly is the so-called "authorization denial handler". Here you will learn more about it, since I've not included this *yet* in the TG2 docs: http://code.gustavonarea.net/repoze.what-pylons/Manual/Protecting.html#using-denial-handlers On Sunday February 15, 2009 12:10:48 Tvrtko wrote: > As a sidenote: I looked up the 403 code which I > thought might help repoze.who decide how to behave > (forget or not), but I found this: > > However, the HTTP specification states that > 403 should only be used when authorization > will not help. Exactly, the 403 status code is the right way. It says "I know who you are and you can't access the resource you requested". As of v2.0beta6, the @require decorator will use 401's and 403's accordingly. Cheers! -- Gustavo Narea <http://gustavonarea.net/>. Get rid of unethical constraints! Get freedomware: http://www.getgnulinux.org/ --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "TurboGears" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/turbogears?hl=en -~----------~----~----~----~------~----~------~--~---
