3 ms·
Github answers 404 instead of a 403 when you try to access a private repository while not being logged in. I assume the rational is to not leak information abo
by BiteCode_dev 4y ago
Github answers 404 instead of a 403 when you try to access a private repository while not being logged in.
I assume the rational is to not leak information about what's private. But still, it's weird.
- throwawaymaths 4y agoThat's exactly correct and has been generally the best practices guidance for decades now.
- deleted 4y ago[deleted]
- dmlittle 4y agoAWS S3 does the opposite when querying objects that don't exist. If you don't have s3:ListObjects permissions on the bucket you'll get a 403 error (you can't differentiate between the object not existing vs. you don't have access to it). I think either approach is valid as long as you're consistent. You can make a case for either 404 or 403 when you don't have enough permissions. In GitHub's case you can argue that it's a 404 because the resource does indeed not exist through your auth context. In AWS' case you can argue that a 403 makes sense because you don't have permission to know the answer to your query.