jacques_chester on Announcing rkt v0.5, featuring pods, overlayfs, and more

Comment on Announcing rkt v0.5, featuring pods, overlayfs, and more parent

A 403 only works in the case that you have an all-or-nothing authentication scheme.

A 403 for a resource that exists but is unauthorised leaks the information that the resource exists.

Many Github customers don't want people to be able to guess at their private repos, and the 404 is the only code that is legitimately able to express the union of "not here" and "not here because you're not allowed to know it's here".

vacri 11y

Not at all. If I have a private repo "foo" and a public repo "bar" and no others, given an unauth'd request:

    > request "foo" => 403
    > request "bar" => 200
    > request "baz" => 403
    > request "qux" => 403

The unauth'd requester can't tell that foo exists and baz and qux do not.

jsprogrammer 11y

Right, but if someone requests:

    > request "lkj3fla3kjf1ljf3jf"

Which doesn't exist anywhere, it makes no sense to return 403.

jacques_chester 11y

Now you're breaking 403, which is not meant to signal the non-existence of a resource. That's what 404 is for.

The "hiding the existence of resources" purpose has to be carried by something. The RFC says it's carried by 404, and that's that.

Comments