4 ms·
They make a request to twilio and their logic checks for a failure response instead of looking for a success response. They are not getting back a different fai
by benmmurphy 6y ago
They make a request to twilio and their logic checks for a failure response instead of looking for a success response. They are not getting back a different failure response and this causes the requests to be incorrectly be marked as success.
For example here is how something like that might break:
/auth
-> returns {"success": true} and 200 on success
-> normally returns {"success": false, "error": "BLAHLBAH"} and 200 on failure
developer checks if response["error"] is null to check if it was successful or not
after your account is disabled /auth starts returning empty json: {} with a 500 error code
oops. now all the requests are incorrectly marked as success. i know this happens because i've seen similar things happen in real life.
the error could also be more obvious and the code just fails open. someone has a try/catch and returns true either because of an accidental mistake or because they don't want users to be locked out when the provider is down.
- nathan815 6y ago> the error could also be more obvious and the code just fails open. someone has a try/catch and returns true either because of an accidental mistake or because they don't want users to be locked out when the provider is down. Failing open would be a catastrophic mistake either way. "The auth provider is down, just let everyone in!"