Databases
StackOverflow2013
Postsdbo
POIs it OK to return a HTTP 401 for a non existent resource instead of 404 to prevent information disclosure?
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POIs it OK to return a HTTP 401 for a non existent resource instead of 404 to prevent information disclosure?
    text
    copied!<p>Inspired by a thought while looking at the question "<a href="https://stackoverflow.com/q/3547474/445073">Correct HTTP status code when resource is available but not accessible because of permissions</a>", I will use the same scenario to illustrate my hypothetical question.</p> <p>Imagine I am building a a carpooling web service.</p> <p>Suppose the following</p> <pre><code>GET /api/persons/angela/location </code></pre> <p>retrieves the current position of user "angela". Only angela herself and a possible driver that is going to pick her should be able to know her location, so if the request is not authenticated to an appropriate user, a <a href="http://tools.ietf.org/html/rfc2616#section-10.4.2" rel="nofollow noreferrer">401 Unauthorized</a> response is returned.</p> <p>Also consider the request</p> <pre><code>GET /api/persons/john/location </code></pre> <p>when no user called john has registered with the system. There is no john resource let alone a resource for john's location, so this obviously returns a <a href="http://tools.ietf.org/html/rfc2616#section-10.4.5" rel="nofollow noreferrer">404 Not Found</a>. Or does it?</p> <p><strong>What if I don't want to reveal whether or not john is registered with the system?</strong></p> <p>(Perhaps the usernames are drawn from a small pool of university logins, and there is a very militant cycling group on campus that takes a very dim view of car usage, even if you are pooling? They could make requests to the URL for every user, and if they receive a 401 instead of 404, infer that the user is a car pooler)</p> <p>Does it make sense to return a <a href="http://tools.ietf.org/html/rfc2616#section-10.4.2" rel="nofollow noreferrer">401 Unauthorized</a> for this request, even though the resource does not exist and there is no possible set of credentials that could be supplied in a request to have the server return a 200?</p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload