better error message for link to private list while logged out

[msilverstar]

Title:
better error message for link to private list while logged out

Area:
user interface

Summary:
I sometimes get logged out by accident, that's fine, I understand. But the error message is user-hostile and very likely to fluster less experienced users.

Description:
I have a named reading filter named "v" that I generally use to avoid big feeds and such. When I get logged out and try to reload the page, I get the following error message:

Forbidden

You don't have permission to access /read/v on this server.
Apache/2.2.11 (Ubuntu) mod_apreq2-20051231/2.6.0 mod_perl/2.0.4 Perl/v5.10.0 Server at msilverstar.dreamwidth.org Port 80

It would be eversomuch nicer to see something like this:

Error: you can't see filters because you aren't the logged user for this account

(with an option to log in)

Poll #8380 better error message for link to private list while logged out

Open to: Registered Users, detailed results viewable to: All, participants: 56

View Respondents

This suggestion:

View Answers

Should be implemented as-is.
49 (87.5%)

Should be implemented with changes. (please comment)
0 (0.0%)

Shouldn't be implemented.
0 (0.0%)

(I have no opinion)
7 (12.5%)

(Other: please comment)
0 (0.0%)

Comments

[azurelunatic]

A meta-suggestion from this one: I wonder if there's a way to automatically detect every time someone gets an error message for which there is no friendly display, and give a report on it so that bugs can be filed to add friendly versions.

[msilverstar]

That's a cool idea, and it would work when if there's an unexpected change that exposes a new error. Though that could be a truckload of messages, especially if there's a bad incoming link.

[azurelunatic]

As I understand how servers work, there are already records when errors happen; I don't believe that invades anyone's inbox. (Now, if something sets off Nagios, on the other hand...) This would be ... maybe a second file? and then setting up a job to analyze that, and maybe sending aggregate results from the analysis every week or so. Sending an email every time there was an error would be a really scary plan.

[denise]

We see in the logs every time there's a server error -- which is not the same as errors shown to the user; it's errors of the form "uninitialized warning at line 3494" type, not the "Oops! Something bad happened!" shown in the browser. We do already monitor the error logs for the server errors and try to patch those (karzilla does a lot of work on that); I'm pretty sure there's no real way to trap and notify about in-browser, in-app errors that users see, not without going through and putting warning lines on each of them, and if you're doing that you might as well just go ahead and make the suggested changes while you're at it.

[azurelunatic]

Ahhh, wrong kind of error. My mistake!

[cesy]

The message would need to be the same for both existing and non-existent filters, of course, so you couldn't tell that someone had an "everyone-except-exampleusername" filter just from typing URLs.

But yes, I would love this - I have reading filters in my bookmarks, and frequently hit the link forgetting that I haven't logged in yet, then have to type in the homepage URL just to log in and go back to the link.

PICKING THROUGH OLD SUGGESTIONS AHOY

[denise]

So, I looked at this a bit hoping that I'd be able to replace that page with a site-skinned error page (that would therefore have all the appropriate menus/links + a clue as to which user you were logged in as), but alas, it returns *so* early on that the place where the error is thrown doesn't even know that site skins are a thing yet. Mucking about with trying to push that return a little later in the process so it could be site-skinned would be a risky change! But we can at least change it so the error is a bit more explanatory (without letting people distinguish between "this filter doesn't exist" and "this filter exists, but you aren't authorized to load it", which is an enumeration attack risk) and includes a link to the login page, so people at least won't be stranded on a bare-metal page with no way out but the back button.