)]}'
{"guidelines/http.rst":[{"author":{"_account_id":12807,"name":"Steve Lewis (stevelle)","email":"stevelle@gmail.com","username":"stevelle"},"change_message_id":"9fee0e9d658293f9e38b8f9b8f93824acdb4fa2a","unresolved":false,"context_lines":[{"line_number":44,"context_line":"Failure Codes"},{"line_number":45,"context_line":"~~~~~~~~~~~~~"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"* If the call results in the OpenStack user exceeding his or her quota, the"},{"line_number":48,"context_line":"  return code should be **403 Forbidden**. Do **not** use **413 Request"},{"line_number":49,"context_line":"  Entity Too Large**."},{"line_number":50,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_22f8f048","side":"PARENT","line":47,"updated":"2015-05-15 19:46:27.000000000","message":"would suggest amending this to resource quota, to not be ambiguous about potential call quotas which is a different concern and does not warrant a 403 status.","commit_id":"df38fc93df82c5714e1fe998db453a48f5171d3e"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"0cd3f2e5fb7df78e3a68d5588057c4f3b8a93287","unresolved":false,"context_lines":[{"line_number":44,"context_line":"Failure Codes"},{"line_number":45,"context_line":"~~~~~~~~~~~~~"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"* If the call results in the OpenStack user exceeding his or her quota, the"},{"line_number":48,"context_line":"  return code should be **403 Forbidden**. Do **not** use **413 Request"},{"line_number":49,"context_line":"  Entity Too Large**."},{"line_number":50,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_451bf61b","side":"PARENT","line":47,"in_reply_to":"7a016987_22f8f048","updated":"2015-05-15 20:04:29.000000000","message":"Steve, that\u0027s not in this patch :)","commit_id":"df38fc93df82c5714e1fe998db453a48f5171d3e"},{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"39562294f2492a7b291df3bd61593f05f10fe9fd","unresolved":false,"context_lines":[{"line_number":45,"context_line":"~~~~~~~~~~~~~"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"* The server **should not** return server-side stacktraces/traceback output"},{"line_number":48,"context_line":"  to the user."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* If the call results in the OpenStack user exceeding his or her quota, the"},{"line_number":51,"context_line":"  return code should be **403 Forbidden**. Do **not** use **413 Request"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_ea360ae6","line":48,"updated":"2015-05-18 15:43:09.000000000","message":"I think \"should not\" as opposed to \"should never\" provides this, but we could expand it to say \"**should not** return ... to the user when it\u0027s not running in debugging mode.\"","commit_id":"5cbfd928149acd15b13242ec79fe07b6263cfe25"},{"author":{"_account_id":12321,"name":"Ryan Brown","email":"rybrown@redhat.com","username":"ryansb"},"change_message_id":"bb2d3720b8581e278b86c8acfa680378f5b6d0e7","unresolved":false,"context_lines":[{"line_number":45,"context_line":"~~~~~~~~~~~~~"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"* The server **should not** return server-side stacktraces/traceback output"},{"line_number":48,"context_line":"  to the user."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* If the call results in the OpenStack user exceeding his or her quota, the"},{"line_number":51,"context_line":"  return code should be **403 Forbidden**. Do **not** use **413 Request"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_078df07a","line":48,"updated":"2015-05-17 19:57:19.000000000","message":"Would it make sense to add that this is alright in debug mode for a service, or to leave that out entirely.","commit_id":"5cbfd928149acd15b13242ec79fe07b6263cfe25"},{"author":{"_account_id":970,"name":"Dean Troyer","email":"dtroyer@gmail.com","username":"dtroyer"},"change_message_id":"74a91c6f2167dbe644f3574620f848a97cbb7998","unresolved":false,"context_lines":[{"line_number":45,"context_line":"~~~~~~~~~~~~~"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"* The server **should not** return server-side stacktraces/traceback output"},{"line_number":48,"context_line":"  to the user."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* If the call results in the OpenStack user exceeding his or her quota, the"},{"line_number":51,"context_line":"  return code should be **403 Forbidden**. Do **not** use **413 Request"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_8ae65dae","line":48,"in_reply_to":"7a016987_a4cef02b","updated":"2015-05-19 18:01:51.000000000","message":"If we open the debug door, then yes, we\u0027ll need to define that.\n\nAlso, is the form of a possible traceback or debug response defined?  If we allow it we need to be specific.  (I\u0027m in lazy-conference-mode and didn\u0027t go look yet)","commit_id":"5cbfd928149acd15b13242ec79fe07b6263cfe25"},{"author":{"_account_id":970,"name":"Dean Troyer","email":"dtroyer@gmail.com","username":"dtroyer"},"change_message_id":"74a91c6f2167dbe644f3574620f848a97cbb7998","unresolved":false,"context_lines":[{"line_number":45,"context_line":"~~~~~~~~~~~~~"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"* The server **should not** return server-side stacktraces/traceback output"},{"line_number":48,"context_line":"  to the user."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* If the call results in the OpenStack user exceeding his or her quota, the"},{"line_number":51,"context_line":"  return code should be **403 Forbidden**. Do **not** use **413 Request"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_2adbe9ed","line":48,"in_reply_to":"7a016987_ea360ae6","updated":"2015-05-19 18:01:51.000000000","message":"Ian, we should stick to the well-defined terms from RFC 2119, that would make this a choice between \u0027should not\u0027 and \u0027must not\u0027.","commit_id":"5cbfd928149acd15b13242ec79fe07b6263cfe25"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"023aa2d958dba7e1296aeaf5e5348fb919783dd7","unresolved":false,"context_lines":[{"line_number":45,"context_line":"~~~~~~~~~~~~~"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"* The server **should not** return server-side stacktraces/traceback output"},{"line_number":48,"context_line":"  to the user."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* If the call results in the OpenStack user exceeding his or her quota, the"},{"line_number":51,"context_line":"  return code should be **403 Forbidden**. Do **not** use **413 Request"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_a4cef02b","line":48,"in_reply_to":"7a016987_ea360ae6","updated":"2015-05-19 16:37:08.000000000","message":"i think a further question is, should we even talk about debug mode here?\n\ndoes it make sense to advise that stack traces can be sent in responses in a debug mode, it might make more sense to have those stack traces in the logs and not send them. i\u0027m not sure what is proper here, just wondering out loud.\n\nalso, this might signal that we should think about a debug guideline.","commit_id":"5cbfd928149acd15b13242ec79fe07b6263cfe25"},{"author":{"_account_id":4190,"name":"lifeless","email":"robertc@robertcollins.net","username":"lifeless"},"change_message_id":"8cdec691a9a5da64965977d7094a3f1bebf7bc82","unresolved":false,"context_lines":[{"line_number":45,"context_line":"~~~~~~~~~~~~~"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"* The server **must not** return server-side stacktraces/traceback output"},{"line_number":48,"context_line":"  to the user."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* If the call results in the OpenStack user exceeding his or her quota, the"},{"line_number":51,"context_line":"  return code should be **403 Forbidden**. Do **not** use **413 Request"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa32b979_5d94be41","line":48,"updated":"2015-06-23 21:39:32.000000000","message":"The Commit message says that this is \u0027should not\u0027, but the prose says this is \u0027must not\u0027. I am confused.\n\nI would like to see should not, I think the debug / trace mode is a useful thing.","commit_id":"a9a8d87b55fca897a09dd39ee917362e65866d8e"},{"author":{"_account_id":4190,"name":"lifeless","email":"robertc@robertcollins.net","username":"lifeless"},"change_message_id":"49e8fb2b351633649a6857c45657d88e0b44f36c","unresolved":false,"context_lines":[{"line_number":45,"context_line":"~~~~~~~~~~~~~"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"* The server **must not** return server-side stacktraces/traceback output"},{"line_number":48,"context_line":"  to the user."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* If the call results in the OpenStack user exceeding his or her quota, the"},{"line_number":51,"context_line":"  return code should be **403 Forbidden**. Do **not** use **413 Request"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a1a9d01_6ba612c3","line":48,"in_reply_to":"9a1a9d01_88aa8c18","updated":"2015-09-25 00:51:54.000000000","message":"@Everett - well, while I agree that stacktraces to users from prod are wrong, integrated debugging w/web tooling is extremely powerful, and closing the door on that isn\u0027t needed - and as Lucas already indicated would be rejected by at least one OpenStack service. If the argument against is just a slippery slope argument, its pretty weak.\n\n@Ken\u0027ichi - so log files require correlation, and thats harder and less immediate than being able to deal with it interactively. We don\u0027t gain anything by forcing such indirection...","commit_id":"a9a8d87b55fca897a09dd39ee917362e65866d8e"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"055d7f858217cc07361b906d0064a23744513afc","unresolved":false,"context_lines":[{"line_number":45,"context_line":"~~~~~~~~~~~~~"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"* The server **must not** return server-side stacktraces/traceback output"},{"line_number":48,"context_line":"  to the user."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* If the call results in the OpenStack user exceeding his or her quota, the"},{"line_number":51,"context_line":"  return code should be **403 Forbidden**. Do **not** use **413 Request"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a1a9d01_88aa8c18","line":48,"in_reply_to":"9a1a9d01_b6402109","updated":"2015-09-25 00:15:50.000000000","message":"I completely agree with Everett here.\n\nFor debugging, why don\u0027t developers/operators/administrators investigate log files on cloud environment instead?","commit_id":"a9a8d87b55fca897a09dd39ee917362e65866d8e"},{"author":{"_account_id":6773,"name":"Lucas Alvares Gomes","email":"lucasagomes@gmail.com","username":"lucasagomes"},"change_message_id":"58fdd8a85ed24ec949bd7d04a40cd7b950652084","unresolved":false,"context_lines":[{"line_number":45,"context_line":"~~~~~~~~~~~~~"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"* The server **must not** return server-side stacktraces/traceback output"},{"line_number":48,"context_line":"  to the user."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* If the call results in the OpenStack user exceeding his or her quota, the"},{"line_number":51,"context_line":"  return code should be **403 Forbidden**. Do **not** use **413 Request"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa32b979_9cb3134d","line":48,"in_reply_to":"fa32b979_5d94be41","updated":"2015-06-24 10:13:28.000000000","message":"FYI in Ironic we leave the traceback *only* if the server is in debug mode[1]. I find that useful as well, so \"should not\" sounds more appropriated indeed.\n\n[1] https://github.com/openstack/ironic/blob/master/ironic/api/hooks.py#L141-L144","commit_id":"a9a8d87b55fca897a09dd39ee917362e65866d8e"},{"author":{"_account_id":177,"name":"Alex Meade","email":"mr.alex.meade@gmail.com","username":"alex-meade"},"change_message_id":"d529e663872f291259907f72462e47b481195820","unresolved":false,"context_lines":[{"line_number":45,"context_line":"~~~~~~~~~~~~~"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"* The server **must not** return server-side stacktraces/traceback output"},{"line_number":48,"context_line":"  to the user."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* If the call results in the OpenStack user exceeding his or her quota, the"},{"line_number":51,"context_line":"  return code should be **403 Forbidden**. Do **not** use **413 Request"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa32b979_3b41c2a9","line":48,"in_reply_to":"fa32b979_5d94be41","updated":"2015-06-23 22:42:41.000000000","message":"I would add some of the why here I think","commit_id":"a9a8d87b55fca897a09dd39ee917362e65866d8e"},{"author":{"_account_id":1112,"name":"Everett Toews","email":"everett.toews@rackspace.com","username":"everett-toews"},"change_message_id":"6c233d71cf52be60cab10d55414a62f1b1dee8d7","unresolved":false,"context_lines":[{"line_number":45,"context_line":"~~~~~~~~~~~~~"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"* The server **must not** return server-side stacktraces/traceback output"},{"line_number":48,"context_line":"  to the user."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* If the call results in the OpenStack user exceeding his or her quota, the"},{"line_number":51,"context_line":"  return code should be **403 Forbidden**. Do **not** use **413 Request"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a1a9d01_b6402109","line":48,"in_reply_to":"fa32b979_9cb3134d","updated":"2015-09-24 16:33:49.000000000","message":"I think it should be left as must not (adding why would be fine but not necessary IMO). Softening it in this first sentence opens the door to ambiguity under what conditions returning a stacktrace is okay.\n\nA caveat could be added that returning a stacktrace during development is okay. Again, I don\u0027t even think that\u0027s really necessary. OpenStack contributors can do whatever they want to during dev/test but those stacktraces must not be revealed to users.","commit_id":"a9a8d87b55fca897a09dd39ee917362e65866d8e"}]}