Not sure if it's actually that helpful but might be nicer to serve up a 404, in the interest of opacity. Simply giving the hacker less information (though not

Not sure if it's actually that helpful but might be nicer to serve up a 404, in the interest of opacity. Simply giving the hacker less information (though not just depending on this) is a useful form of security. If you give them a 401, then they at least know that the file exists.