Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Explorer API returns HTTP 403 forbidden for non-existent resources #29

Open
adamretter opened this issue Sep 22, 2020 · 2 comments
Open

Explorer API returns HTTP 403 forbidden for non-existent resources #29

adamretter opened this issue Sep 22, 2020 · 2 comments
Assignees
@adamretter
Labels
question Further information is requested

Comments

@adamretter
Copy link
Member

adamretter commented Sep 22, 2020 •
edited
Loading

When accessing a resource that does not exist via the /explorer API, we should we return HTTP 403 or HTTP 404. Arguable 403 is more secure, but perhaps misleading... we need to give this some thought.
@adamretter adamretter added the question Further information is requested label Sep 22, 2020
@adamretter adamretter self-assigned this Sep 22, 2020
@adamretter adamretter changed the title /explorer API returns HTTP 403 forbidden for non-existent resources Explorer API returns HTTP 403 forbidden for non-existent resources Sep 22, 2020
@duncdrum
Copy link
Contributor

duncdrum commented Jul 7, 2021

has thought been given? 403 seems the better choice to me, not sure how it is misleading because the /explorer endpoint is there?

@adamretter
Copy link
Member Author

I think that if the user is authorized and the resource does not exist then the response should be 404, if the user is not authorized that takes priority and the response should be 403

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@adamretter adamretter

Labels
question Further information is requested
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@adamretter @duncdrum