5

I am currently working on a web application where there are different levels of access. Users can get access to some areas of the application, but may not be allowed to access another area.

The application is built with clean URLs, such as: http://mysite.com/projects/newproject1

The system determines what the user can access and creates buttons/menus/links for those items. The user will never see a link/button or menu to something that he does not have access to.

However, since the application is built with clean URLs, someone who should not have access to the project module or "newproject1" in the project module can try and access that area directly via the URL. The URL might be sent to them by another email, or they could just be trying to be smart and see if they can access that area of the application.

I am currently considering to treat all "forbidden request" cases as a "Page not found" error:

  • Instead of sending a 403 in the HTTP response, a 404 will be sent.
  • A message tell them that the page is unavaliable instead of one saying that they are not allowed to access it and to contact their sysadmin for any questions.
  • The same will apply for page not found errors. A 404 will be sent, and we will display a message saying the page is unavaliable.

Is this a good idea?

Improve this question
6
  • At first glance your question sounds more technical than it is. If I understand right you just want to say "file not found" to always imply that a page doesn't exist? Lots of sites do this, Stack Exchange itself (I believe) gives the 404 page if you go to a deleted question you can't view.
    – Zelda
    Commented Dec 21, 2011 at 3:32
  • 5
    So you don't want users to know whether the URL they tried actually exists, right? Are you sure about that? If people who use the system who have different access levels talk to each other, they might share a link or tell someone to go somewhere that they don't have access to. If that person get's a "Page not found", they might think something is broken. This might not apply in your situation, tho.
    – peteorpeter
    Commented Dec 21, 2011 at 3:33
  • I'm wondering now, does Stack Exchange actually give the 404 error code when a page is forbidden or is it just the same visible error message? I've never heard of spoofing the actual response codes like that.
    – Zelda
    Commented Dec 21, 2011 at 3:35
  • @BenBrocka: Don't know about the code, but from the page itself it is entirely clear that the question was deleted and only viewable for the owner and people with enough rep to view deleted questions.
    – Marjan Venema
    Commented Dec 21, 2011 at 8:53
  • @MarjanVenema Oh, so it does. Interestingly SE sites DO return a 404 in this case as well. Generally I think 404 is probably preferable because it's likely the only (if any) error code moderately web savvy people recognize.
    – Zelda
    Commented Dec 21, 2011 at 14:45

3 Answers 3

Reset to default
9

Since your question essentially is 'Is this a good idea?', I would say No, it is not.

Users may be 'trying to be smart' or actually smarter, how would you know? What if the user is a UI designer/ PHP developer himself?

If you would like to spoof a 404, I suggest you do it in such a way that the message can be interpreted both ways. A knowledgeable user will understand that it means a 'Keep Off' signal, while a naive visitor might plainly see a 'sorry, no.'

I really liked it when they came up with that "That's all we know." complete with a period at the end of it.

Improve this answer
5
  • Who is "they" in your "I really liked it when they..."?
    – Marjan Venema
    Commented Dec 21, 2011 at 8:54
  • 1
    @MarjanVenema I think Kris is talking about Google's 404
    – Roger Attrill
    Commented Dec 21, 2011 at 9:00
  • @MarjanVenema I thought everyone's noticed it by now. Yes, you're right, Roger!
    – Kris
    Commented Dec 21, 2011 at 9:27
  • 3
    the error codes are there for a reason and are standardized. a 403 should be a 403. That is not to say that your 403 and 404 pages can't look identical in a human readable format, but the header should be 403 (i.e. return the correct error).
    – horatio
    Commented Dec 21, 2011 at 18:43
  • @horatio: I agree with you. That's the reason I said 'If you would like to spoof a 404,' i.e., if you want to do it anyway, then.
    – Kris
    Commented Dec 22, 2011 at 9:11
3

Well, if they are curious or trying to be smart, with a web crawler or some tool like that, or even googlebots, they will see a lot of 404's, but they won't desist. The 403 is a "stop right there", the 404 seems like a "bad luck, try again". Also, it will be hard for good users to tell you if they have problems with access or another kind, because all they see is 404's.

Improve this answer
0

This is more of a back-end answer. No not a good idea, If you want change the UI side to make the 403 and a 404 page look the same.

However on the response side it is still important for some to know weather the page dosent exist or the page is forbidden

I don't know what your app looks like or what the purpose of your project is, But lets say you ask me to do some back-end crawling to your website, And when debugging I keep getting a 404 response, This is very confusing as I will presume the page dosent exist, And move on to try fixing some other end. However if you throw a 403 I know exactly at that point, Ahhh. The server is not allowing me in, I must be doing something wrong.

But if you are worried about the users, Getting confused with 403 make the front end to look like a 404 page!

If you are worried about security, Then make sure your 403 are always right and no one can by pass them.

The ammount of times i have seen Response 200 sent when clearly the page says 404 not found. This Is bad bad and very bad!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.