From 8b6f77203d220eeec5dc8647dda210a8667448c7 Mon Sep 17 00:00:00 2001 From: jknapp Date: Thu, 17 Sep 2026 16:38:15 -0700 Subject: [PATCH] Return a descriptive error message with the sign-up URL instead of a bare 403 A real HTTP redirect doesn't make sense for a JSON API client -- most either ignore a 3xx or follow it into an HTML page where they expected JSON, which is worse than a clean failure. Returning error text that includes the web sign-up URL is what actually reaches a human, since most Mastodon apps surface that string on-screen when a request fails. --- zz_altcha.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/zz_altcha.rb b/zz_altcha.rb index 129ec20..dd0a2c0 100644 --- a/zz_altcha.rb +++ b/zz_altcha.rb @@ -210,8 +210,14 @@ Rails.application.config.to_prepare do private + # Not a real HTTP redirect -- these are JSON API clients (app + # backends), not browsers, so a 3xx + Location header either gets + # silently ignored or blindly followed into an HTML page where the + # app expected JSON, which is worse than just failing. A descriptive + # `error` message is what actually reaches a human: most Mastodon + # apps surface that string on-screen when a request fails. def block_api_account_creation - forbidden + render json: { error: "Account creation via the API is disabled on this server. Please sign up at #{new_user_registration_url}." }, status: 403 end end end