Comment on Announcing rkt v0.5, featuring pods, overlayfs, and moreparentComments−vacri11yNot at all. If I have a private repo "foo" and a public repo "bar" and no others, given an unauth'd request: > request "foo" => 403 > request "bar" => 200 > request "baz" => 403 > request "qux" => 403 The unauth'd requester can't tell that foo exists and baz and qux do not.−jsprogrammer11yRight, but if someone requests: > request "lkj3fla3kjf1ljf3jf" Which doesn't exist anywhere, it makes no sense to return 403.−jacques_chester11yNow you're breaking 403, which is not meant to signal the non-existence of a resource. That's what 404 is for.The "hiding the existence of resources" purpose has to be carried by something. The RFC says it's carried by 404, and that's that.
Comments
Not at all. If I have a private repo "foo" and a public repo "bar" and no others, given an unauth'd request:
The unauth'd requester can't tell that foo exists and baz and qux do not.Right, but if someone requests:
Which doesn't exist anywhere, it makes no sense to return 403.Now you're breaking 403, which is not meant to signal the non-existence of a resource. That's what 404 is for.
The "hiding the existence of resources" purpose has to be carried by something. The RFC says it's carried by 404, and that's that.