# Passing an api\_username for a user that does not exist returns a 500 with no useful context

**URL:** https://meta.discourse.org/t/passing-an-api-username-for-a-user-that-does-not-exist-returns-a-500-with-no-useful-context/46407
**Category:** Development
**Created:** [6월 24, 2016, 4:06오후 UTC](https://meta.discourse.org/t/passing-an-api-username-for-a-user-that-does-not-exist-returns-a-500-with-no-useful-context/46407 "2016-06-24T16:06:12Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![cappslock](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cappslock/32/120789_2.png) [@cappslock](https://meta.discourse.org/u/cappslock)
#### Post date: [6월 24, 2016, 4:06오후 UTC](https://meta.discourse.org/t/passing-an-api-username-for-a-user-that-does-not-exist-returns-a-500-with-no-useful-context/46407/1 "2016-06-24T16:06:12Z")

</div>

On the beta branch, when attempting to create a POST on behalf of a user, I use the API and provide the username as the `api_username`. Because of the way I’m managing users, the user may not exist in Discourse at this time and I’d like to be able to respond to that exception by creating the user. It would be useful if the error had enough context to determine that this case occurred, but instead, it’s raising a Discourse::InvalidAccess and the server is returning a 500.

Strack trace:

```plaintext
lib/auth/default_current_user_provider.rb:57:in `current_user'
lib/current_user.rb:30:in `current_user'
app/helpers/application_helper.rb:59:in `html_classes'
app/views/layouts/application.html.erb:2:in `_app_views_layouts_application_html_erb__210758119167932006_91259420'
app/controllers/application_controller.rb:496:in `build_not_found_page'
app/controllers/application_controller.rb:134:in `rescue_discourse_actions'
app/controllers/application_controller.rb:117:in `block in <class:ApplicationController>'
config/initializers/100-quiet_logger.rb:13:in `call_with_quiet_assets'
config/initializers/100-silence_logger.rb:26:in `call'
lib/middleware/missing_avatars.rb:21:in `call'
lib/middleware/turbo_dev.rb:33:in `call'

```

I can work around this, but it would be nice if the server responded with something in the 4xx range and enough information to determine the cause of the issue.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [6월 24, 2016, 10:28오후 UTC](https://meta.discourse.org/t/passing-an-api-username-for-a-user-that-does-not-exist-returns-a-500-with-no-useful-context/46407/2 "2016-06-24T22:28:02Z")

</div>

Sure I am all for better, more descriptive errors – @techapj can you add to your list?

---

<div class="post-metadata">

### Author: ![cappslock](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cappslock/32/120789_2.png) [@cappslock](https://meta.discourse.org/u/cappslock)
#### Post date: [7월 28, 2016, 6:50오후 UTC](https://meta.discourse.org/t/passing-an-api-username-for-a-user-that-does-not-exist-returns-a-500-with-no-useful-context/46407/3 "2016-07-28T18:50:04Z")

</div>

Just curious, is there an issue or something else I can follow related to this bug? I have a bit of code to work around it that I’d like to rip out once I know that I can 🙂

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [7월 28, 2016, 7:28오후 UTC](https://meta.discourse.org/t/passing-an-api-username-for-a-user-that-does-not-exist-returns-a-500-with-no-useful-context/46407/4 "2016-07-28T19:28:29Z")

</div>

I am confident @techapj will get to it in due time.

---

<div class="post-metadata">

### Author: ![techAPJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/techapj/32/342990_2.png) [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [7월 30, 2016, 7:55오후 UTC](https://meta.discourse.org/t/passing-an-api-username-for-a-user-that-does-not-exist-returns-a-500-with-no-useful-context/46407/5 "2016-07-30T19:55:46Z")

</div>

> [@cappslock](#):
>
> it’s raising a Discourse::InvalidAccess and the server is returning a 500.

This is actually by design as per:

> <https://github.com/discourse/discourse/blob/16a383ea1ee73e1d62da49b467a2e9fb7ea607b0/lib/auth/default_current_user_provider.rb#L68-L72>

> [@cappslock](#):
>
> enough information to determine the cause of the issue.

I believe `Discourse::InvalidAccess` is enough to determine that

- either username is incorrect
- or api\_key is incorrect

If both of the above is correct than you will get specific error message.

I hope this helps.

---

<div class="post-metadata">

### Author: ![cappslock](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cappslock/32/120789_2.png) [@cappslock](https://meta.discourse.org/u/cappslock)
#### Post date: [7월 30, 2016, 10:07오후 UTC](https://meta.discourse.org/t/passing-an-api-username-for-a-user-that-does-not-exist-returns-a-500-with-no-useful-context/46407/6 "2016-07-30T22:07:01Z")

</div>

Thanks for the reply. In my tests, it would reply with a 500 with no  
response body. It’s impossible to know the reason for the failure in that  
case. I would think something in the 4xx range with some information  
indicating the cause of the error (a username that does not exist) would be  
more helpful and appropriate, no?

---

<div class="post-metadata">

### Author: ![techAPJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/techapj/32/342990_2.png) [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [7월 31, 2016, 2:41오전 UTC](https://meta.discourse.org/t/passing-an-api-username-for-a-user-that-does-not-exist-returns-a-500-with-no-useful-context/46407/7 "2016-07-31T02:41:48Z")

</div>

Are you using official [discourse\_api](https://github.com/discourse/discourse_api) gem?

I just tried the same using official discourse\_api and got `403 Forbidden` with proper error message:

```plaintext
{"errors"=>["You are not permitted to view the requested resource."], "error_type"=>"invalid_access"} (DiscourseApi::UnauthenticatedError)

```

---

<div class="post-metadata">

### Author: ![cappslock](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cappslock/32/120789_2.png) [@cappslock](https://meta.discourse.org/u/cappslock)
#### Post date: [7월 31, 2016, 2:54오전 UTC](https://meta.discourse.org/t/passing-an-api-username-for-a-user-that-does-not-exist-returns-a-500-with-no-useful-context/46407/8 "2016-07-31T02:54:40Z")

</div>

No, I’m just hitting the API via HTTP. I’ll provide a CURL command when I’m  
back to my computer.

---

<div class="post-metadata">

### Author: ![cappslock](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cappslock/32/120789_2.png) [@cappslock](https://meta.discourse.org/u/cappslock)
#### Post date: [8월 2, 2016, 3:03오후 UTC](https://meta.discourse.org/t/passing-an-api-username-for-a-user-that-does-not-exist-returns-a-500-with-no-useful-context/46407/9 "2016-08-02T15:03:37Z")

</div>

Here’s an example curl command with sensitive data stripped out:

```plaintext
curl -X POST -H "Content-Type: application/x-www-form-urlencoded" -d 'raw=demo of failing post on behalf of non-existent api-user&title=herp derp jerp' "<my_discourse_instance>/posts?api_key=<valid_api_key>&api_username=<nonexistent_username>" -i

```

---

<div class="post-metadata">

### Author: ![techAPJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/techapj/32/342990_2.png) [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [8월 2, 2016, 6:51오후 UTC](https://meta.discourse.org/t/passing-an-api-username-for-a-user-that-does-not-exist-returns-a-500-with-no-useful-context/46407/10 "2016-08-02T18:51:59Z")

</div>

Try making cURL request in this format:

```plaintext
curl -X POST -H "Accept: application/json" -H "Content-Type: application/json" -d '{"raw":"demo of success post"}' <my_discourse_instance>/posts?api_key=<valid_api_key>&api_username=<nonexistent_username>

```

You will get exact response and error message you are looking for.
