Repository navigation
Explorer API returns HTTP 403 forbidden for non-existent resources #29
Description
When accessing a resource that does not exist via the /explorer API, we should we return HTTP 403 or HTTP 404. Arguable 403 is more secure, but perhaps misleading... we need to give this some thought.
Activity
[-]/explorer API returns HTTP 403 forbidden for non-existent resources[/-][+]Explorer API returns HTTP 403 forbidden for non-existent resources[/+]duncdrum commentedon Jul 7, 2021
has thought been given?
403seems the better choice to me, not sure how it is misleading because the/explorerendpoint is there?adamretter commentedon Jul 7, 2021
I think that if the user is authorized and the resource does not exist then the response should be
404, if the user is not authorized that takes priority and the response should be403