3 ms·

404 already Edit: not sure what makes this comment so controversial (at least 5 downvotes already) , the link does indeed 404 if you aren't logged in.

by ryanlol 11y ago

Kristine1975 11y ago
GitHub now has 11,995,201 open issues.
sachkris 11y ago
It is not 404. You need to log in.
- Washuu 11y ago
  That is a terrible design by them. It should be 403 Forbidden.
  - shangxiao 11y ago
    It's a pattern to prevent information leakage
    - Washuu 11y ago
      I assume to prevent exposing the names of private repositories, correct? For the main(global) search page it would seem reasonable easy to just omit that from the search results.
      - stephengillie 11y ago
        This way it can't be brute-scraped either.
    - danneu 11y ago
      That makes sense for endpoints like /admin, but it's more confusing than it's worth for users when the endpoint is otherwise rather public. Well, just see this comment thread. As an example, in this case with the /issues page, redirecting to `/login?redirect-to=/issues` would be more user-friendly since it signals that the page exists but you must authenticate.
  - sachkris 11y ago
    No, 403 implies the resource is unavailable even after authorization. 401 Unauthorized maybe the right one here.
    - Matt3o12_ 11y ago
      Giving a 401 indicates that there might be a resource, though, which can also be harmful. It is fairly common to return a 404 to unauthorized users (or users with not enough permission) so you don't give away meta information. Granted, for the public search, it should return an appropriate error code but they should not do that for private repositories. Thus it think it is fair to assume that they have a policy: if user/guest does not have sufficient permission, always return an error 404.
- dayta 11y ago
  GitHub returns a 404 when you're not logged in, so ryanlol's statement is correct. Just try it, before claiming it is not curl -I https://github.com/issues?utf8=%E2%9C%93&q=is%3Aopen+is%3Aissue+ https://github.com/issues?utf8=%E2%9C%93&q=is%3Aopen+is%3Ais...

404 already Edit: not sure what makes this comment so controversial (at least 5 downvotes already) , the link does indeed 404 if you aren't logged in.

by ryanlol 11y ago

404 already Edit: not sure what makes this comment so controversial (at least 5 downvotes already) , the link does indeed 404 if you aren't logged in.

Kristine1975 11y ago

GitHub now has 11,995,201 open issues.

sachkris 11y ago

It is not 404. You need to log in.

Washuu 11y ago
That is a terrible design by them. It should be 403 Forbidden.
- shangxiao 11y ago
  It's a pattern to prevent information leakage
  - Washuu 11y ago
    I assume to prevent exposing the names of private repositories, correct? For the main(global) search page it would seem reasonable easy to just omit that from the search results.
    - stephengillie 11y ago
      This way it can't be brute-scraped either.
  - danneu 11y ago
    That makes sense for endpoints like /admin, but it's more confusing than it's worth for users when the endpoint is otherwise rather public. Well, just see this comment thread. As an example, in this case with the /issues page, redirecting to `/login?redirect-to=/issues` would be more user-friendly since it signals that the page exists but you must authenticate.
- sachkris 11y ago
  No, 403 implies the resource is unavailable even after authorization. 401 Unauthorized maybe the right one here.
  - Matt3o12_ 11y ago
    Giving a 401 indicates that there might be a resource, though, which can also be harmful. It is fairly common to return a 404 to unauthorized users (or users with not enough permission) so you don't give away meta information. Granted, for the public search, it should return an appropriate error code but they should not do that for private repositories. Thus it think it is fair to assume that they have a policy: if user/guest does not have sufficient permission, always return an error 404.
dayta 11y ago
GitHub returns a 404 when you're not logged in, so ryanlol's statement is correct. Just try it, before claiming it is not curl -I https://github.com/issues?utf8=%E2%9C%93&q=is%3Aopen+is%3Aissue+ https://github.com/issues?utf8=%E2%9C%93&q=is%3Aopen+is%3Ais...