3 ms·

My whole point was that you should choose your 404s in a way that doesn't allow 403s to give away information. For example, on Github we know that a user is at

My whole point was that you should choose your 404s in a way that doesn't allow 403s to give away information. For example, on Github we know that a user is at github.com/username, we also know that whether or not a user exists is public information. So if we GET github.com/nonexistantuser, that should return a 404. A user's repo, however is not public information, so when a request is made to github.com/username/nonexistantrepo that should return a 403, unless you have privileges to know that information, if you were, for example that logged in user, only THEN should you give the 404.

Walkman 11y ago
I think this overcomplicates this. Based on your thought process github.com/nonexistinguser would throw 404, because well, whether or not a user exists is public information, but the same thing (a resource doesn't exist) github.com/username/nonexistantrepo would throw 403 so you have to check the url and make something conditionally if you are a client... Also it makes more sense and more simple to me that something I don't know about simply doesn't exists for me. :)