Subject: [NNTP] When to use 440 for POST?

From: Julien ÉLIE <[email-masked]>
Date: Tue, 12 Jan 2010 08:31:32 +0100

Hi,

Following a discussion on news.software.nntp:

    http://groups.google.fr/group/news.software.nntp/browse_frm/thread/3d0059fe42fa4933
    <news:[email-masked]>

where POST (wrongly) answers 440 in INN instead of 480 when posting
is not allowed but authentication can occur, what is expected to
be sent if POST is still not allowed after authentication?

RFC 4643:

   Note that a server may perform a successful authentication exchange
   with a client and yet still deny access to some or all resources; the
   permanent 502 response indicates that a resource is unavailable even
   though authentication has been performed (this is in contrast to the
   temporary 480 error, which indicates that a resource is unavailable
   now but may become available after authentication).

RFC 3977:

   If posting is
   prohibited for some installation-dependent reason, a 440 response
   MUST be returned.

      502: It is necessary to terminate the connection and to start a new
      one with the appropriate authority before the command can be used.

Does it mean that 502 is the right answer to POST when it is not possible
for a user to POST articles (but others may be able to POST)?

RFC 3977 takes precedence over RFC 4643 but 502, as a generic answer,
is also defined by RFC 3977.

The only example in RFC 3977 is:

   Example of an attempt to post when posting is not allowed:

      [Initial connection set-up completed.]
      [S] 201 NNTP Service Ready, posting prohibited
      [C] POST
      [S] 440 Posting not permitted

Had the greeting been 200, would 502 have been used?  Or is 502 an invalid
answer after POST?
What are usual cases of use for 440?

-- 
Julien ÉLIE

« Un dictionnaire est comme une montre ; il vaut mieux en avoir un
  que pas du tout, mais le meilleur n'est jamais tout à fait exact. »
  (Georges-Bernard Shaw)

---

From: Julien ÉLIE <[email-masked]>
Date: Sat, 23 Jan 2010 14:27:08 +0100

Hi all,

In Section 6.3.1.3 of RFC 3977:

There is an edge-case with Section 2.2 of RFC 4643:

Does the following suggestion is right when POST is not allowed
for the connected (and/or authentified) user?
INN currently always answers 440 but it seems to be a bug.

* greeting = 200
  POST => 480
  we authenticate
  POST => 502

* greeting = 201
  POST => 440
  we authenticate anyway
  POST => 440

Or something else should be done?

> What are usual cases of use for 440?

I've found one in INN:  limiting how many articles a user can send
per minute/hour.  POST returns 440 when the limit has been reached.

-- 
Julien ÉLIE

« -- Maintenant les Romains sont alertés.
  -- En tout cas, ceux-là ne sont plus très alertes ! » (Astérix)