Add status codes to crypto/credential failures#836
Conversation
| (when (not (crypto/verify-signature pubkey signing-input signature)) | ||
| (throw (ex-info "Verification failed." {:error :credential/invalid-signature :credential credential}))) | ||
| (throw (ex-info "Verification failed, invalid credential." | ||
| {:status 400 |
There was a problem hiding this comment.
Should we consider using a 403 here?
There was a problem hiding this comment.
That's what I did at first but then reconsidered as the request itself is invalid but definitely a gray area.
I did a quick google search and found other tools doing 400 so that was enough to nudge in this direction. Certainly open for debate though.
There was a problem hiding this comment.
Yeah, according to MDN:
The HTTP 403 Forbidden response status code indicates that the server understands the request but refuses to authorize it.
I would expect a 400 for malformed requests (which includes an invalid credential) and a 403 for a valid credential, but insufficient permissions.
There was a problem hiding this comment.
That makes perfect sense, I'm happy with the 400.
Add error message status code to crypto verification exceptions