Hacker News Reader

Separating those cases expsoses the existence of an object, even if you can't access it.

Whether that matters is up to you, but I get the impression most people just default to not exposing existence. There is 403 which helps split these.

View on HN

How does 403 help? Isn’t that for when authentication worked but authorization didn’t?

Correct. You’re supposed to send 403 only when 1. you’ve successfully “logged in” with a set of credentials, but 2. the user that those credentials map to, doesn’t have rights on the resource. If you haven’t authed at all, and there’s a resource there requiring auth, you’re supposed to send 401.

This usage of 403 should be used carefully. It's often (probably usually) the case that you still don't want to expose existence of a resource even to an authenticated user who is not authorized to that resource. It's generally better to return 404 in that case.

The distinction is whether the resource is owned by another tenant or not. Often a user can view a resource but aren't allowed to edit it, at which point 403 is correct. However if it's something owned by another tenant entirely, and is not public, then a 404 is correct.

Reply on news.ycombinator.com