I am annoyed by (but respect) APIs that take it a level further and don't even give you a 403 to say you're unauthorised, they just give you a 404 because anything else would acknowledge that the resource you requested actually existed

[–] wheezy@lemmy.ml 8 points 2 days ago (2 children)

Wouldn't unauthorized only be meant for AFTER a login is successful?

Like, the user should have to have an active session first. Maybe you're just talking about that case though.

[–] bountygiver@lemmy.ml 0 points 15 hours ago (1 children)

unauthorized (403) is still valid for unlogged in as you can permit anonymous access to certain resources.

unauthenticated (401) is for when you should be redirecting the user to the login page

[–] wheezy@lemmy.ml 1 points 15 hours ago* (last edited 15 hours ago)

Thanks. I think I might have been misreading these in my head. Dyslexia is a dickhead. The number codes really helped.

[–] smeg@feddit.uk 1 points 2 days ago

Maybe I meant unauthenticated. What is this, mandatory cybersecurity education!?

[–] Pika@sh.itjust.works 6 points 2 days ago* (last edited 2 days ago) (2 children)

I don't respect them because most instances a 403 is more than adequate for your security. The only time I agree with having a 404 over a 403 would be file-specific pathing, but realistically the entire file directory should be a 403 instead of a 404, And then if the user is authorized to access the resource(but it isn't there), then it gives a 404.

[–] Lifter@discuss.tchncs.de 1 points 1 day ago (1 children)

But if there is no resource, how can the system know whether they are authorized? 403 it is.

[–] Pika@sh.itjust.works 1 points 18 hours ago* (last edited 18 hours ago)

Whether you respond as a 404 or a 403 would be dependent on whether or not the user who is logged in has the authorization to read the previous directory.

A site administrator, for example, would have the authority to read the previous directory, which means that the site administrator would know whether or not the resource existed or not(as the previous directory would list it) so in which case a 404 would be proper. However, a user who doesn't have authority to read the previous directory should not have the ability to know whether or not it exists. so a 404 would not be proper here because the proper one would be a 403 because it's inherited from the previous directory.

edit: changed traverse to read, as traversal doesn't mean you can see what else is there.

[–] qqq@lemmy.world 1 points 1 day ago

Yea, it doesn't matter too much in most instances, but there are times when it might, especially if the URL itself has some meaning embedded in it. For example if part of the path is a SHA sum of some content, which is fairly common, it might be bad to allow someone to determine if that resource exists

[–] Xavienth@lemmygrad.ml 2 points 2 days ago

Couldn't you just try and register the username to see if it's valid?

[–] gibson@sopuli.xyz 2 points 2 days ago

While true most of these websites expose valid usernames in other places