Home/ Questions/Q 48521
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-10T16:17:35+00:00

OK, probably best to give an example here of what I mean. Imagine a

  • 0

OK, probably best to give an example here of what I mean.

Imagine a web based forum system, where the user authentication is done by some external method, which the system is aware of.

Now, say for example, a user enters the URL for a thread that they do not have access to. For this should I return a 403 (Forbidden), letting the user know that they should try another authentication method, or a 404, not letting them know that there is something there to access.

Assuming I return a 403, should I also return a 403 when they access a URL for a topic that doesn’t exist yet?

Edit: the example above was more of an example that something IRL.

Another Example, say I expose something like

/adminnotes/user

if there are Administrator notes about the user. Now, returning a 403 would let the user know that there is something there being said about them. A 404 would say nothing.

But, if I were to return a 403 – I could return it for adminnotes/* – which would resolve that issue.

Edit 2: Another example. Soft deleted Questions here return a 404. Yet, with the right authentication and access, you can still see them (I’d presume)

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Above everything else, comply with HTTP spec. Returning 403 in place of 404 is not a good thing. Returning 404 in place of 403 probably is ok (or not a big blunder), but I would just let the software tell the truth. If user only knows the ID of a topic, it’s not much anyway. And he could try timing attacks to determine whether this topic exists.

    • 0