Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: neutral (nike.apache.org: local policy)
MIME-Version: 1.0
In-Reply-To: <C403D6CD-5F05-4AD9-9103-E811BE7C170D@couchbase.com>
References: 
 <CA+5KyPSE3BULUc7KONgx8ZqfNKW++_r8vgdhh7HLxLr0JgfM0A@mail.gmail.com>
 <CAONf+LQKjE6NVCsLKWb3wzmWOwrS2ej+_PCJS4Z=uV3hj0OtOg@mail.gmail.com>
 <CAOHkvcP0XMAFvvFhaw3azEyqBxPMhNxFwkYX+5_x52ScSaxEbg@mail.gmail.com>
 <CAMkGvyNO4GC8e+PWu8u7BpV6b4OUvXZ3v37y5kpnXdrYgn_nBA@mail.gmail.com>
 <4E371B93.8060303@kearns.net.au>
 <CAAL6JQj_u0RgDhQG95oFrQfJ3MUeRXHb+Q6d1Cc6DEBUwaE_vA@mail.gmail.com>
 <CAONf+LTt0Hmuhx8PTs_LdzzX-fHQDAhQg_kJabTQAnfnBdxZqQ@mail.gmail.com>
 <CAOHkvcNutCimOggckR3ivc2=DCAP1ZhPTC2XpnP1o_E82_Pvaw@mail.gmail.com>
 <CA+5KyPR56FpKXiQ6Zyxu0V2jwaKbOghbTZyJ10Ou=YXyyk6zhA@mail.gmail.com>
 <CAONf+LTd+qQtLBb7iXb-H_HJs4Xm+t+Bw0G4CMLCC8X=bYwdFQ@mail.gmail.com>
 <CAAL6JQhytD90Jn3f7LT-HUMVH=T5GgTEMXWzaR6kQ5BgqZGRSw@mail.gmail.com>
 <CAAL6JQjbpOD9GOu-dDDf7-1-44pANT3U=ZKaNYEBXPcX11C8pA@mail.gmail.com>
 <CAN-3CBLheiAds-L5Vps-amEHN-F-17yRqHzbzNzAq-Ev9BKa5g@mail.gmail.com>
 <CAMWZAjnE9p2QB7zujjGqL-JiLMnbbimmuz3V-f+pW_bNeL4hng@mail.gmail.com>
 <CAN-3CBLog0VMXZYN622+3ZN=_JV09fi1UTW54rFR=-3nP6+sVQ@mail.gmail.com>
 <CABvT1DHODFHdq3Uu6AcKGuk+Vmf+EJvV0Lyj=Q7A_iAehst+iw@mail.gmail.com>
 <CAJNb-9p--g2d_UMWAtSjbyTLRYdt_h0T0sLckX5k=+HJ2kyUHg@mail.gmail.com>
 <CAMWZAj=8GRLuvF2GDr=bi=g05j9_w+JBt76ohmscNX2Pvz4Eqw@mail.gmail.com>
 <CAJNb-9pQGzvZ8pmqSxoY0Jyk+8Z+sXYzYgTgOmqiVr3Ww+hDaw@mail.gmail.com>
 <CAMWZAjmSY_jdvyZ4+tjbO6TdbRAUb+gd4UhVrbSKTgvNmrgRJQ@mail.gmail.com>
 <CAN-3CB+LwerwsdcxLfRW70NwWvHDiTg7spRKJ0tBAZQzsuX8QA@mail.gmail.com>
 <CAMWZAjms30L_TosKNt54Bqn9fHteJOuuanYKqnA-UrAa6+Bkcw@mail.gmail.com>
 <CABvT1DEZYDTe5YLX=LOA1raLPtUq_MgPNFQKbf5z2Ff6PWqS3g@mail.gmail.com>
 <CAMWZAj=SP+9V5J+gigHpH8TAGfDBOdz0815P0=zwtyFA+ZhjAw@mail.gmail.com>
 <EB6A293C-E6D6-4BE7-8D70-23587A84D5DA@couchbase.com>
 <CAMWZAjmNCxesgOWu8iZePuigyjEz9w0iWWEBA5BoPfPkh4HXCw@mail.gmail.com>
 <CABvT1DGbE5mR9ncPnZkeeX7DWMu3_QqwBafV6y6Oh5_KtRAGXw@mail.gmail.com>
 <CAMWZAjk4z_51=it71oh--cXU+h_kxfz4FmNH7M8-Pbxy6T1m9g@mail.gmail.com>
 <CABvT1DFi=zRUmgvZfZMxU=JE2TNDp_VWFhwJ1Ygo98ZWzBw69g@mail.gmail.com>
 <C403D6CD-5F05-4AD9-9103-E811BE7C170D@couchbase.com>
From: Jason Smith <jhs@iriscouch.com>
Date: Wed, 17 Aug 2011 09:47:33 +0700
Message-ID: 
 <CAN-3CBJzhQrY9qmhdgRQGYijWiNgaKeMAFJBOE2FZPctdf5b-w@mail.gmail.com>
Subject: Re: to CouchApp or not to CouchApp
To: user@couchdb.apache.org
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Aug 17, 2011 at 12:55 AM, Jens Alfke <jens@couchbase.com> wrote:
> IMHO the best behavior is:
>
> - CouchDB intrinsically returns a 401, with the required WWW-Authenticate=
 header. That is the correct HTTP behavior when the client is trying to acc=
ess a read-protected resource without being authenticated.
>
> - There would be some way for a CouchApp to intercept and override this r=
esponse, so that it can instead return a custom response such as a 302 redi=
rect to its own login page.
>
> Returning a 302 rather than a 401 is prioritizing the app-server usage of=
 CouchDB over the REST/database server usage, and I think that=E2=80=99s ba=
ckwards. I agree with prior messages in this thread that CouchApps are nift=
y but limited, and we shouldn=E2=80=99t be breaking regular HTTP behavior i=
n the server just so that CouchApps can show fancy login pages.

Totally agree.

However, once again, the word "CouchApp" confuses the discussion and
muddies the waters.

Forget about "CouchApp."

You click a link or bookmark and your browser (ultimately) goes to
couch.com:5984/db/some_doc/some_attachment.html. But you aren't
authorized.

The *standard* response and also the Couchy response is 401.

The *typical* response that all web apps actually do (because they are
not simultaneously REST databases) is 302 bounce to a login page.

I am really loving this discussion. It is a tough problem. Thanks very
much to Marcello for keeping it going. Today I will investigate what
happens if you return 401 with WWW-Authenticate and also a Location
header. Is that allowed? Maybe we will get lucky and browsers will
bounce. Crossing fingers.

--=20
Iris Couch