Subject: [NNTP] 502 and 503

From: "Clive D.W. Feather" <[email-masked]>
Date: Thu, 18 Nov 2004 09:00:26 +0000

This started as a debate about what the correct code is for a command
that's not supported in the current server mode (e.g. IHAVE after MODE
READER, or ARTICLE on a transit-only server).

Russ Allbery said:
> I think what's making me leery is that, prior to our document, 503 meant
> "something went wrong in processing your command that was probably
> transient."  This is a somewhat more permanent error than what people have
> been using 503 to mean in the past.
> 
> 503 is, for example, the return code that INN returns to AUTHINFO if it
> can't fork an external authenticator, the return code that it returns to
> LIST if the active file can't be found, or the return code that it returns
> to DATE if localtime() fails.

>> 502 doesn't make sense, because it implies that reconnecting can give
>> you the appropriate authority.
> 
> I'm not sure why it would imply that.  502 means "permission denied"; it
> is certainly entirely reasonable for that state to be permanent for that
> client.  For example, a read-only reader server is going to return 502 to
> POST from now until the end of time, and reconnecting all you want won't
> help.

The current definitions are:

* If the server experiences an internal fault or problem that means it is
  unable to carry out the command (for example, a necessary file is missing
  or a necessary service could not be contacted), the response code 403 MUST
  be returned.

* If the server recognizes the command but does not provide an optional
  feature  (for example because it does not store the required information),
  or only handles a subset of legitimate cases (see the HDR command for an
  example), the response code 503 MUST be returned.

* If the client is not authorized to use the specified facility when
  the server is in its current state, then the appropriate one of the
  following response codes MUST be used.
  502: it is necessary to terminate the connection and start a new one with
       the appropriate authority before the command can be used.

Long ago we had a thread about the confusion between "something's broken"
and "I don't do that", and decided that 403 was right for the former. So:
> 503 is, for example, the return code that INN returns to AUTHINFO if it
> can't fork an external authenticator, the return code that it returns to
> LIST if the active file can't be found, or the return code that it returns
> to DATE if localtime() fails.
is wrong; these should all be 403s, because they indicate that the server
will eventually sort the problem out and the client can't do anything to
help.

Given that, have we got the right definitions for 502 v 503, or do we need
to revisit them? To me, the meanings are:
  502: you made a wrong choice, disconnect and try again
  503: I don't do that

-- 
Clive D.W. Feather  | Work:  <[email-masked]>   | Tel:    +44 20 8495 6138
Internet Expert     | Home:  <[email-masked]>  | Fax:    +44 870 051 9937
Demon Internet      | WWW: http://www.davros.org | Mobile: +44 7973 377646
Thus plc            |                            |

---

From: "maurizio codogno" <[email-masked]>
Date: Thu, 18 Nov 2004 09:27:12 +0000

>From: "Clive D.W. Feather" <[email-masked]>

>  502: you made a wrong choice, disconnect and try again

I agree. If the error is transient, the relevant code should be 
a 4xx, not a 5xx. 
503 should mean "never will I do that" :-)

ciao, .mau.

---

From: Russ Allbery <[email-masked]>
Date: Tue, 30 Nov 2004 19:54:36 -0800

> 503 should mean "never will I do that" :-)

You're thinking SMTP and not NNTP.  4xx and 5xx in NNTP historically have
nothing at all to do with transient vs. permanent.  We're sort of shifting
in that direction vaguely, but we'll never get there entirely.

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: Russ Allbery <[email-masked]>
Date: Tue, 30 Nov 2004 19:57:07 -0800

>        the appropriate authority before the command can be used.

Ah, okay, I'd forgotten about 403, which we invented.  Hurm.  Okay.  We're
really changing a lot about error codes, but I think it's generally an
improvement and we've hashed this out before, so let's stick with what we
decided.

> will eventually sort the problem out and the client can't do anything to

Right.

>   502: you made a wrong choice, disconnect and try again

I really don't want to describe 502 that way.  If, for example, you
connect to a public read-only server, POST is going to return 502 in the
common case because the server *supports* POST, it's just been configured
to deny that particular client access to the command.  But it's going to
keep returning 502 forever.

It's really:

  502: permission denied, at least in this mode
  503: command not supported

That being said, given the above explanation, I'm okay with IHAVE in
reader mode or POST in transit mode being 503.