4 ms·

Separating those cases expsoses the existence of an object, even if you can't access it. Whether that matters is up to you, but I get the impression most peopl

• nnutter 7y ago
  How does 403 help? Isn’t that for when authentication worked but authorization didn’t?
  • derefr 7y ago
    Correct. You’re supposed to send 403 only when 1. you’ve successfully “logged in” with a set of credentials, but 2. the user that those credentials map to, doesn’t have rights on the resource. If you haven’t authed at all, and there’s a resource there requiring auth, you’re supposed to send 401.
    • eyelidlessness 7y ago
      This usage of 403 should be used carefully. It's often (probably usually) the case that you still don't want to expose existence of a resource even to an authenticated user who is not authorized to that resource. It's generally better to return 404 in that case.
      • mmerickel 7y ago
        The distinction is whether the resource is owned by another tenant or not. Often a user can view a resource but aren't allowed to edit it, at which point 403 is correct. However if it's something owned by another tenant entirely, and is not public, then a 404 is correct.