Linking to emails that require authentication is confusing

[raboof]

When linking to an email that requires authentication, the UI shows the "An error occured" due to the 404 error reported by https://lists.apache.org/api/thread.lua . Users must first close the error box, and then use the 'profile' icon in the top-right to log in. This turns out to be non-obvious to some users, causing them to assume links to important information are broken and ignoring them.

I think it would be good to show page that makes it more obvious that you might need to log in on 404, or perhaps even consider returning a 401 from thread.lua in this case and redirect people to the login page automatically.

[madrob]

I think there's something to be said for not disclosing the existence of an email when a user is unauthorised, but for most links where it's just a hash in the url and not even a list name, I don't think we're protecting much at the expense of a non obvious error message.

+1 to this issue

[sebbASF]

As I recall, returning 404 for an email that requires auth is intentional. If a person is not authorised, they should not be able to determine if a private email exists or not.

[sebbASF]

The dialog box already says that the user may need to login; maybe it just needs to be made more obvious what to do?

Can the dialog box include a login button?

Note that one can click the login button without needing to close the dialog box first.
In either case, upon successful auth, the email will be displayed (if it exists and the user has karma).
I think it's important that this feature is not lost if the error response is changed from a dialog to a page.