You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Nick Stokes <ra...@gmail.com> on 2010/12/07 16:59:57 UTC
meaningful error messages in http
Hi all,
I am serving our repositories over https, using Apache 2.2, via mod_dav_svn,
also using mod_authz_svn for per directory access control. Most users find
the error messages cryptic (when there is a permission related error on
checkout, commit, so on...) and I am wondering if there is a way to
customize these messages?
For example, current (default?) set up spits out the following:
*If checkout fails due to insufficient permissions:*
svn: Server sent unexpected return value (403 Forbidden) in response to
OPTIONS request for 'https://my.cool.server/foo/trunk'
*If checkout fails due to spelling error in repository* *name:*
svn: Server sent unexpected return value (403 Forbidden) in response to
OPTIONS request for 'https://my.cool.server/f00/trunk'
*If commit fails due to insufficient permissions:*
svn: Commit failed (details follow):
svn: Server sent unexpected return value (403 Forbidden) in response to
MKACTIVITY request for
'/svn/site-macros/!svn/act/d5936c16-fd56-4f62-a9f1-b1285bea6c7'
Thanks for any leads,
Nick
Re: meaningful error messages in http
Posted by Nick Stokes <ra...@gmail.com>.
On Wed, Dec 8, 2010 at 5:13 AM, Johan Corveleyn <jc...@gmail.com> wrote:
[snip]
> Most users don't know (or don't care) about HTTP error codes. And I
> bet 99.9% of svn users don't know what an OPTIONS request is (and
> they certainly don't care).
>
> Cheers,
>
Couldn't have said it better... On your earlier comment:
Moreover, one would expect these kinds of error message to be exactly
> the same regardless of the underlying protocol or server type (unless
> it's some kind of protocol-specific error, like e.g. SSL handshake
> failure or something (which should also be made into user-sensible
> error messages, but might not be generic over all protocols)).
>
Completely agree. Just wondering, is there a technical reason why subversion
wasn't already that way?
>
> I don't know if there is already an issue for this in the issue
> tracker, but regardless ... maybe we could have a useful discussion on
> this mailing list about what the error messages should say
> specifically?
>
What you proposed are fine, and I guess the more consistent with svnserve
the better. What would be curious to find if there is any one out there for
who these messages are essential. (your guess number 0.1% may be optimistic
:)
Nick
Re: meaningful error messages in http
Posted by Johan Corveleyn <jc...@gmail.com>.
On Wed, Dec 8, 2010 at 1:26 AM, Curley, John <Jo...@windriver.com> wrote:
>
> -----Original Message-----
> From: Johan Corveleyn [mailto:jcorvel@gmail.com]
> Sent: Tuesday, December 07, 2010 12:36 PM
> To: Nick Stokes
> Cc: Andy Levy; users@subversion.apache.org
> Subject: Re: meaningful error messages in http
>
> On Tue, Dec 7, 2010 at 9:18 PM, Nick Stokes
> <ra...@gmail.com> wrote:
>>
>>
> ... SNIP ...
>>
>> No. I did not propose that. The question was simple: Is there way to
>> customize error messages from httpd server (akin to customizing logs in
>> apache as in http://tinyurl.com/svn-apache-logs)? When users see "Server
>> sent unexpected return value..." they assume there is something wrong with
>> the server itself, despite the keyword "Forbidden" that follows. Besides,
>> there is the redundant/misleading/irrelevant-for-client stuff there
>> (OPTIONS, MKACTIVITY, repos ID). e.g. svnserve error messages are much
>> better.
>
> Yes, I completely agree.
>
> It's not about the server sending better messages, but about the
> client (or client library or whatever) to transform that error message
> into something meaningful for the user. The svn client knows what
> operation the user is trying to execute, so it should be able to
> formulate something sensible in the context of that operation.
>
> Moreover, one would expect these kinds of error message to be exactly
> the same regardless of the underlying protocol or server type (unless
> it's some kind of protocol-specific error, like e.g. SSL handshake
> failure or something (which should also be made into user-sensible
> error messages, but might not be generic over all protocols)).
>
> I don't know if there is already an issue for this in the issue
> tracker, but regardless ... maybe we could have a useful discussion on
> this mailing list about what the error messages should say
> specifically?
>
> What would be most helpful for the user, in a concise and to-the-point
> way, concrete enough yet not too extremely technical, maybe giving
> some hints about what could be the cause, ... in all kinds of use
> cases?
>
> Cheers,
> --
> Johan
>
>
> ----------------- My Response ------------------
>
> I partially agree with Johan and Nick.
>
> Being able to customize the messages would be good. 403 seems like a generic "did not work" code. However, I think in this case, one would need to add more Apache/SVN error codes. Having a (I am making this up) 403.1 - repository not found, 403.2 - authentication failed, et cetera, may be helpful.
>
> Where I disagree is in a secure environment. You probably do not want to acknowledge server names, or repository names if someone is snooping around.
>
> Maybe that might be a difference between http: and https:. Just a thought.
No, that's not what I mean. Don't want to leak any more information
than necessary. The server's error messages are fine, it's just that
the client should translate that into user-language.
For example:
If checkout fails due to insufficient permissions:
Instead of:
svn: Server sent unexpected return value (403 Forbidden) in
response to OPTIONS request for 'https://my.cool.server/foo/trunk'
it could be:
svn: permission denied accessing 'https://my.cool.server/foo/trunk'
or:
svn: checkout of 'https://my.cool.server/foo/trunk' failed because
of insufficient permissions.
or something with "authorization failed".
or ...
And that error message could be exactly the same whether you're using
Apache or svnserve (error has nothing to do with the protocol).
Most users don't know (or don't care) about HTTP error codes. And I
bet 99.9% of svn users don't know what an OPTIONS request is (and
they certainly don't care).
Cheers,
--
Johan
RE: meaningful error messages in http
Posted by "Curley, John" <Jo...@windriver.com>.
-----Original Message-----
From: Johan Corveleyn [mailto:jcorvel@gmail.com]
Sent: Tuesday, December 07, 2010 12:36 PM
To: Nick Stokes
Cc: Andy Levy; users@subversion.apache.org
Subject: Re: meaningful error messages in http
On Tue, Dec 7, 2010 at 9:18 PM, Nick Stokes
<ra...@gmail.com> wrote:
>
>
... SNIP ...
>
> No. I did not propose that. The question was simple: Is there way to
> customize error messages from httpd server (akin to customizing logs in
> apache as in http://tinyurl.com/svn-apache-logs)? When users see "Server
> sent unexpected return value..." they assume there is something wrong with
> the server itself, despite the keyword "Forbidden" that follows. Besides,
> there is the redundant/misleading/irrelevant-for-client stuff there
> (OPTIONS, MKACTIVITY, repos ID). e.g. svnserve error messages are much
> better.
Yes, I completely agree.
It's not about the server sending better messages, but about the
client (or client library or whatever) to transform that error message
into something meaningful for the user. The svn client knows what
operation the user is trying to execute, so it should be able to
formulate something sensible in the context of that operation.
Moreover, one would expect these kinds of error message to be exactly
the same regardless of the underlying protocol or server type (unless
it's some kind of protocol-specific error, like e.g. SSL handshake
failure or something (which should also be made into user-sensible
error messages, but might not be generic over all protocols)).
I don't know if there is already an issue for this in the issue
tracker, but regardless ... maybe we could have a useful discussion on
this mailing list about what the error messages should say
specifically?
What would be most helpful for the user, in a concise and to-the-point
way, concrete enough yet not too extremely technical, maybe giving
some hints about what could be the cause, ... in all kinds of use
cases?
Cheers,
--
Johan
----------------- My Response ------------------
I partially agree with Johan and Nick.
Being able to customize the messages would be good. 403 seems like a generic "did not work" code. However, I think in this case, one would need to add more Apache/SVN error codes. Having a (I am making this up) 403.1 - repository not found, 403.2 - authentication failed, et cetera, may be helpful.
Where I disagree is in a secure environment. You probably do not want to acknowledge server names, or repository names if someone is snooping around.
Maybe that might be a difference between http: and https:. Just a thought.
Happy Holidays,
John
Re: meaningful error messages in http
Posted by Johan Corveleyn <jc...@gmail.com>.
On Tue, Dec 7, 2010 at 9:18 PM, Nick Stokes
<ra...@gmail.com> wrote:
>
>
> On Tue, Dec 7, 2010 at 1:11 PM, Andy Levy <an...@gmail.com> wrote:
>>
>> On Tue, Dec 7, 2010 at 11:59, Nick Stokes
>> <ra...@gmail.com> wrote:
>> > Hi all,
>> >
>> > I am serving our repositories over https, using Apache 2.2, via
>> > mod_dav_svn,
>> > also using mod_authz_svn for per directory access control. Most users
>> > find
>> > the error messages cryptic (when there is a permission related error on
>> > checkout, commit, so on...) and I am wondering if there is a way to
>> > customize these messages?
>> >
>> > For example, current (default?) set up spits out the following:
>> >
>> > If checkout fails due to insufficient permissions:
>> > svn: Server sent unexpected return value (403 Forbidden) in response to
>> > OPTIONS request for 'https://my.cool.server/foo/trunk'
>> >
>> > If checkout fails due to spelling error in repository name:
>> > svn: Server sent unexpected return value (403 Forbidden) in response to
>> > OPTIONS request for 'https://my.cool.server/f00/trunk'
>>
>> I don't think Subversion can tell the difference here. If my AuthZ
>> file specifies that I have access to /f00/trunk/ and I ask for
>> /foo/trunk/, all that's really known is that I asked for a path which
>> I do not have permission to access. Do you propose that the server
>> scan for all possible "similar" repositories/paths in an attempt to
>> find a match?
>>
>
> No. I did not propose that. The question was simple: Is there way to
> customize error messages from httpd server (akin to customizing logs in
> apache as in http://tinyurl.com/svn-apache-logs)? When users see "Server
> sent unexpected return value..." they assume there is something wrong with
> the server itself, despite the keyword "Forbidden" that follows. Besides,
> there is the redundant/misleading/irrelevant-for-client stuff there
> (OPTIONS, MKACTIVITY, respos ID). e.g. svnserve error messages are much
> better.
Yes, I completely agree.
It's not about the server sending better messages, but about the
client (or client library or whatever) to transform that error message
into something meaningful for the user. The svn client knows what
operation the user is trying to execute, so it should be able to
formulate something sensible in the context of that operation.
Moreover, one would expect these kinds of error message to be exactly
the same regardless of the underlying protocol or server type (unless
it's some kind of protocol-specific error, like e.g. SSL handshake
failure or something (which should also be made into user-sensible
error messages, but might not be generic over all protocols)).
I don't know if there is already an issue for this in the issue
tracker, but regardless ... maybe we could have a useful discussion on
this mailinglist about what the error messages should say
specifically?
What would be most helpful for the user, in a concise and to-the-point
way, concrete enough yet not too extremely technical, maybe giving
some hints about what could be the cause, ... in all kinds of use
cases?
Cheers,
--
Johan
Re: meaningful error messages in http
Posted by Nick Stokes <ra...@gmail.com>.
On Tue, Dec 7, 2010 at 1:11 PM, Andy Levy <an...@gmail.com> wrote:
> On Tue, Dec 7, 2010 at 11:59, Nick Stokes
> <ra...@gmail.com> wrote:
> > Hi all,
> >
> > I am serving our repositories over https, using Apache 2.2, via
> mod_dav_svn,
> > also using mod_authz_svn for per directory access control. Most users
> find
> > the error messages cryptic (when there is a permission related error on
> > checkout, commit, so on...) and I am wondering if there is a way to
> > customize these messages?
> >
> > For example, current (default?) set up spits out the following:
> >
> > If checkout fails due to insufficient permissions:
> > svn: Server sent unexpected return value (403 Forbidden) in response to
> > OPTIONS request for 'https://my.cool.server/foo/trunk'
> >
> > If checkout fails due to spelling error in repository name:
> > svn: Server sent unexpected return value (403 Forbidden) in response to
> > OPTIONS request for 'https://my.cool.server/f00/trunk'
>
> I don't think Subversion can tell the difference here. If my AuthZ
> file specifies that I have access to /f00/trunk/ and I ask for
> /foo/trunk/, all that's really known is that I asked for a path which
> I do not have permission to access. Do you propose that the server
> scan for all possible "similar" repositories/paths in an attempt to
> find a match?
>
>
No. I did not propose that. The question was simple: Is there way to
customize error messages from httpd server (akin to customizing logs in
apache as in http://tinyurl.com/svn-apache-logs)? When users see "Server
sent unexpected return value..." they assume there is something wrong with
the server itself, despite the keyword "Forbidden" that follows. Besides,
there is the redundant/misleading/irrelevant-for-client stuff there
(OPTIONS, MKACTIVITY, respos ID). e.g. svnserve error messages are much
better.
Re: meaningful error messages in http
Posted by Andy Levy <an...@gmail.com>.
On Tue, Dec 7, 2010 at 11:59, Nick Stokes
<ra...@gmail.com> wrote:
> Hi all,
>
> I am serving our repositories over https, using Apache 2.2, via mod_dav_svn,
> also using mod_authz_svn for per directory access control. Most users find
> the error messages cryptic (when there is a permission related error on
> checkout, commit, so on...) and I am wondering if there is a way to
> customize these messages?
>
> For example, current (default?) set up spits out the following:
>
> If checkout fails due to insufficient permissions:
> svn: Server sent unexpected return value (403 Forbidden) in response to
> OPTIONS request for 'https://my.cool.server/foo/trunk'
>
> If checkout fails due to spelling error in repository name:
> svn: Server sent unexpected return value (403 Forbidden) in response to
> OPTIONS request for 'https://my.cool.server/f00/trunk'
I don't think Subversion can tell the difference here. If my AuthZ
file specifies that I have access to /f00/trunk/ and I ask for
/foo/trunk/, all that's really known is that I asked for a path which
I do not have permission to access. Do you propose that the server
scan for all possible "similar" repositories/paths in an attempt to
find a match?
Some would consider it a security risk to report "that exists, but you
don't have rights to it" as opposed to "access denied." It's similar
to *NIX systems and any other decent authentication interface
reporting "invalid user id OR password" on a failed login attempt;
don't give a potential attacker hints as to which part of their
attempt they got correct.