用Flask + Python处理无效的GET / POST请求参数的最佳方法？

Question

Whats the best way to handle invalid parameters passed in with a GET or POST request in Flask+Python?

Let's say for the sake of argument I handle a GET request using Flask+Python that requires a parameter that needs to be an integer but the client supplies it as a value that cannot be interpreted as an integer. So, obviously, an exception will be thrown when I try to convert that parameter to an integer.

My question is should I let that exception propagate, thus letting Flask do it's default thing of returning an HTTP status code of 500 back to the client? Or should I handle it and return a proper (IMO) status code of 400 back to the client?

The first option is the easier of the two. The downside is that the resulting error isn't clear as to whose at fault here. A system admin might look at the logs and not knowing anything about Python or Flask might conclude that there's a bug in the code. However, if I return a 400 then it becomes more clear that the problem might be on the client's end.

What do most people do in these situations?

Answer 1

HTTP 400 seems good to me.

Returning 500 in this case is wrong. It provides no information to the client, and they will assume that the problem is with the server, not the client.

There is nothing stopping you from adding a body to the 400 response that identifies the parameter with the invalid value (or whatever the problem was). Use whatever representation the client accepts, eg if it's an API you might return a JSON response:

{"error": "parameter age: positive integer required"}

Answer 2

If you look at most of the REST APIs, they will return 400 and appropriate error message back to the client if the user sends request parameters of a different type than is expected. So, you should go with your 2nd option.

Answer 3

A status code of 400 means you tell the client "hey, you've messed up, don't try that again". A status code of 500 means you tell the client "hey, I've messed up, feel free to try again later when I've fixed that bug".

In your case, you should return a 400 since the party that is at fault is the client.