search

SeisComP3 / seiscomp3

SeisComP is a seismological software for data acquisition, processing, distribution and interactive analysis.
Other
111 stars 88 forks source link

[fdsnws] use response code 403 if access to all requested data was denied #205

Closed andres-h closed 6 years ago

andres-h commented 6 years ago

Dataselect normally uses 2 HTTP status codes -- 200 (data available) and 204/404 (no data available). Unauthorized data is simply filtered out, which can be confusing -- a user getting 204/404 does not know if data is not available at all or he is not authorized to get restricted data. In the latter case he should contact the data center.

This pull request replaces 204/404 by 403 (forbidden) if access to all requested data was denied. If the request includes non-restricted channels, still 204/404 is used for compatibility reasons. We decided to not add an additional non-standard query parameter like "noaccess=403", which would make client logic more complex (some servers give bad request error if unsupported query parameters are used).

Note that 403 is listed as "Authentication failed or access blocked to restricted data" in table 1 of FDSN Web Service Specifications (Common HTTP status codes returned by FDSN services).

In addition:

  1. Unauthorized time windows are logged with tracker as DENIED.
  2. The 404 page shows "no metadata found" if the request does not include any existing channels.