If you can avoid making a request that to the knowledge of your client has to fail, don't make it. This has the benefit that it allows you to give clear and ti

If you can avoid making a request that to the knowledge of your client has to fail, don't make it. This has the benefit that it allows you to give clear and timely feedback to your client and potentially to your users. As for the problem outlined here: If you can reach any private, for-your-users-eyes-only endpoint without authentification you suck at what you do and you should probably change into a profession where you can deal less damage.