We attempted to run a switchover on a master/slave cluster via the mariadbmon. The cluster was in a bit of unexpected (to MaxScale at least) sate, so it rejected the switchover.

However, when doing this, MaxScale returned HTTP code 403 Forbidden which is incorrect. The HTTP specs clearly say that 403 should only be used for authentication or authorisation failures that cannot be remedied. Since MaxScale rejected our command due to its state (andnot due to wrong credentials or insufficient access permissions), it should have replied probably with 409 "Conflict" ("Indicates that the request could not be processed because of conflict in the current state of the resource"). As a last resort, 400 "Bad request" could be used whenever a more suitable HTTP code does not exist.

This issue may well affect other parts of MaxScale - we accidentally stumbled on this particular one and did not investigate its behaviour deeper.

It should be noted that the short name of an HTTP code could be misleading. Always check the full description (e.g, 406 "Not acceptable" does not mean that the request cannot be accepted due to some general error, but specifically because it would be properly fulfilled, producing an output that does not match the Accept header of the request).

Wikipedia has a good reference on HTTP codes:
https://en.wikipedia.org/wiki/List_of_HTTP_status_codes

Error as printed by maxctrl:

Error: Server at https://127.0.0.1:8989 responded with 403 Forbidden to `POST maxscale/modules/mariadbmon/switchover?MariaDB-Monitor&server1&server2`

{

    "links": {

        "self": "https://127.0.0.1:8989/v1/maxscale/modules/mariadbmon/switchover/"

    },

    "meta": {

        "errors": [

            {

                "detail": "'server2' is not a valid demotion target for switchover: it does not have a 'gtid_binlog_pos'."

            },

            {

                "detail": "Switchover cancelled."

            }

        ]

    }

}

After we fixed the cluster state to match MaxScale's expectations, the very same switchover command succeeded, once again confirming that 403 was inappropriate code to use.