[sldev] Re: [VWR] Web login without llmozlib

[Argent Stonecutter]

On 2007-12-26, at 07:48, Alissa Sabre wrote:

>>> What's wrong with including the human readable message after the
>>> 307? That's what that part of the HTTP protocol is for.
>

> No.  It's a bad idea because you can't translate it into user's
> language.

Why not? Where in the spec does it say that the human-readable  
message for the status code can't be based on the same  
internationalization policies as anything else in the response?

This message, in this case, is generated by the same software that is  
generating the message in the body, and should follow the same policy  
as the same message in the body. There's even an HTTP/1.1 header,  
"Vary", for the server to inform the client that the response was  
modified based on an entry in the header.

Eg:
     Request:
	GET /ixnay HTTP/1.1
	Accept-Language pig-latin

     Response:
	HTTP/1.1 404 Onay Uchsay Agepay
	Vary: Accept-Language

Possibly it should follow something similar to RFC 3463 (supersedes  
1893), where there's a detailed status code buried in the response.

Or, better, use RFC 2774

	HTTP/1.1 307 Moved Temporarily
	Opt: "http://xxx.secondlife.com/authentication"; ns=23
	23-Status: 307.42 Account on hold
	23-Language-Encoding: en-us...

http://www.faqs.org/rfcs/rfc2774.html

Yes, this is an experimental protocol, but it's documented in  
RFC-4229 so it's not going to conflict.

> The message after the error code is not for users; it is for
> developers and experienced administrators.

The message after the status code is routinely delivered to end- 
users, by all kinds of software, when it's the best available  
response (for example, a fatal error with no body). The only software  
that I have run into that goes to great lengths to hide this  
information is Internet Explorer... and any time IE does something  
different than the rest of the world the odds are pretty overwhelming  
that it's not the rest of the world that's messed up (this is not to  
say that anything by Microsoft is suspect, just that IE seems to have  
become Microsoft's resident foulup fairy).