3 ms·
That happens when you disable directory enumeration (or whatever name that has) on S3. In that case, it sends 403s (permission denied) instead of 404s.
by glandium 6y ago
That happens when you disable directory enumeration (or whatever name that has) on S3. In that case, it sends 403s (permission denied) instead of 404s.
- wiredfool 6y agoI know, but try explaining that to someone in very small words. There is no admin. There is no login. The api has open CORS because we want reuse and there’s no risk because there’s literally no concept of identity in the app. Everything is public data or f(public). Scanners see things through their eyes, and they’re not used to static/public. I the end, It was easier just to rewrite 403 into 404.