CODEWITHSUNDEEP
httphttp-status-code-404
Shea Levy
Shea Levy

Reputation: 5415

Can an HTTP server respond with a 404 to conceal the existence of a resource?

There may be cases where a client that doesn't have authorization to access a resource should be told that it doesn't exist instead of being told they aren't authorized. If a server does this, is it technically a violation of HTTP 1.1?

Upvotes: 1

Views: 76

Answers (1)

pi.
pi.

Reputation: 21542

There is nothing in the RFC that forces you to tell the client the truth every time.

In the end it boils down to how you want the people behind the browser to react to a certain response. If you would send a 403 Forbidden the user would know they may not access this resource (and no authentication window would open automatically). If you instead were to send a 404 Not Found they could think to themselves that the server operator (you) made an error.

Your choice.

Upvotes: 1

Related Questions