Hacker News Reader

Comment by 3pt14159 | Hacker News Reader

Edit: This comment comes off as overly critical. I really do love these diagrams, I've just had this argument so many times with people I find it frustrating.

I completely disagree with this part of the diagram:

https://imgur.com/HZS3cVy

If the resource is secret then the entire guessable path should return a 401 or a 403, not a 404. Knowing whether something exists is a privilege that a user needs to authenticate in order to gain. This isn't just an academic distinction. Github does 404s for unauthenticated requests and python's default http client (at least for python 2) doesn't send credentials unless it hits a 403 or a 401. Since github sends a 404 you have to hack around the language.

404 means Not Found. But that isn't true. The real status code is Forbidden and it should be used on all possible urls that follow a guessable pattern.

View on HN

I think that you have a point as far as staying true to what the status codes mean, but it comes with a price. To make the resource invisible to the user by 404ing instead of 403ing, you protect yourself from people searching for endpoints that return personal info... and all urls are guessable. If you get a hit on some resource in a sea of 404s, you are that much closer to gaining private info.

But if there is a chance that a resource exists at all, then that whole range of URLs should return 403, regardless of whether or not they exist.

Sometimes 403 give away information (The resource you tried to reach exists) which you don't want to give away at all because it's much secure.

My whole point was that you should choose your 404s in a way that doesn't allow 403s to give away information.

For example, on Github we know that a user is at github.com/username, we also know that whether or not a user exists is public information. So if we GET github.com/nonexistantuser, that should return a 404.

A user's repo, however is not public information, so when a request is made to github.com/username/nonexistantrepo that should return a 403, unless you have privileges to know that information, if you were, for example that logged in user, only THEN should you give the 404.

I think this overcomplicates this. Based on your thought process github.com/nonexistinguser would throw 404, because well, whether or not a user exists is public information, but the same thing (a resource doesn't exist) github.com/username/nonexistantrepo would throw 403 so you have to check the url and make something conditionally if you are a client...

Also it makes more sense and more simple to me that something I don't know about simply doesn't exists for me. :)

That's how Amazons S3 works, secret or non existent resources return 403.

Reply on news.ycombinator.com