search

TurboGears / tg2

Python web framework with full-stack layer implemented on top of a microframework core with support for SQL DBMS, MongoDB and Pluggable Applications
http://www.turbogears.org/
Other
806 stars 78 forks source link

Safely get identity from authentication metadata (TGAuthMetadata) #98

Closed victor-torres closed 6 years ago

victor-torres commented 6 years ago

The TGAuthMetadata class could be overridden by users. TurboGears should catch possible exceptions raised by customizations in the get methods.

victor-torres commented 6 years ago

This also covers the case when the user has an active session, but the tg2 could not connect to the database. This could be reproduced in a vanilla tg2 app with debug = false in the .ini config file.

In this case, the user is presented with a message instead of regular error document page: Internal Server Error.

coveralls commented 6 years ago

Coverage Status

Coverage decreased (-0.07%) to 99.934% when pulling a1763960b74062d79a2513f93b24c8981059e663 on victor-torres:identity into b5e4b8b4286d4ad24ee4b7a6fada2157e6966f55 on TurboGears:development.

amol- commented 6 years ago

This is not something that the framework should handle. If the application crashes, the framework should properly report it as a "Server Error".

Also I don't feel this is in general a good idea, if there is an error the user will just get randomly logged out. If you can recover from the error the implemented TGAuthMetadata should try to recover (for example retrying the database query) , if it's an error you can't recover from the app should just report a server error to the client.

Hiding software failures is generally a very bad idea and it's better to fail quick and near to the real error source.

victor-torres commented 6 years ago

Thanks for your time reviewing this code. I understand your point of view.