2

If a user attempts to view a private repo on GitHub when they are not logged in, they get a 404 error page.

Pro) It seems that the repo does not exist to those lacking proper access. This might help with security - perhaps a hacker is first trying to see if the repo in online in the first place.

Con) It seems that the repo does not exist to those who are accidentally not logged in. This can a surprise to people who don't understand the function of this 404 page and now think their repo is gone.

What do you guys think of using a 404 page in this scenario? What would you suggest as an alternative to keeping repos private/secure but perhaps not using a 404?

  • 1
    Imagine that you navigate to your mail inbox directly without logging in. Would it make sense to display a 404 page, instead of redirecting you to a login screen? I the changes that this increases security is slim, but it surely will confuse end-users. – jff Mar 11 '14 at 18:50
  • I agree, hence the question. rgthree helped clarify the uniqueness of GitHub's situation. – avi Mar 14 '14 at 14:03
8

First, let's clarify what you are asking. A "404 Not Found" page corresponds to a 404 response header from the server. Technically, there are other headers a server could send if you are not authorized to view the current uri, such as "403 Forbidden" or "401 Unauthorized" etc.

However, I believe what you are actually asking is not necessarily what header to respond with but what to actually display to the user when a user does not have access to a uri. The answer to that is really up to the web service to handle, as the "correct" answer could really be one way or the other per situation.

In your example using Github, you've identified that private repositories should not be able to be identified if you do not have access. In a case where Github decided to display a "unauthorized" message when we do hit a private repo's uri then we could attempt to use that information maliciously. For instance, if we got the following:

https://github.com/microsoft/outlook -- Returns 404 Not Found
https://github.com/apple/ios8        -- Returns 404 Not Found
https://github.com/google/gmail      -- Returns 403 Forbidden

Then we know for sure that the user "google" keeps a repo called "gmail" on github. That knowledge alone could be used to further maliciously attempt to gain access. But, if all those addresses returned the same 404 regardless of whether or not they exist, then we would have no idea one way or the other.

On the flip side, let's say a service's shares photos publicly, and every public photo has a predictable /edit added to the URI.

:: Authenticated as "rgthree"
http://myphotos.com/user/rgthree/photos/000000001/     - 200 Success
http://myphotos.com/user/rgthree/photos/000000001/edit - 200 Success
http://myphotos.com/user/avi/photos/000000001          - 200 Success
http://myphotos.com/user/avi/photos/000000001/edit     - 403 Forbidden

In this case it's fine to let me know I do not have editable access; there's no need to hide the fact that the endpoint is protected.

  • That google repository shouldn't respond "403 Forbidden" but "401 Authentication needed". "Forbidden" means nobody is ever allowed to access the data, not even Google engineers with the right username and password. "401" means you need authentication (usually you need authentication to even find out whether the object exists or not, so we don't know at this point that the google repo exists). – gnasher729 Jan 21 '15 at 18:06
7

I consider it a bad experience that Github is showing a 404 page for a private repo since 404 pages are generally used to indicate a dead end in a website or when a page doesn't exist. To quote this article

What is a 404 page? It is a page that tells your visitors when they go to a specific page that it no longer exists.

A better user experience would be to inform the user that this a private repo and he will need the appropriate credentials to view it and provide him with a link to go to the login page or allow him to login from there itself.

enter image description here

Even after logging in, if the user cannot view the repositary, then it would be better to show an error message informing him that he has no access permissions on the content and hence he cannot view it.

Here is an nice example of the error message for the second case

enter image description here

  • I like this answer and think that is the case 9/10 times. I accepted rgthree's answer because they helped explain why GitHub (or similar services) would need a unique case, for the sake of security. – avi Mar 14 '14 at 14:02
2

The 404 or Not Found error message is a HTTP standard response code indicating that the client was able to communicate with the server, but the server could not find what was requested.

It is not intended for your scenario where user does not have credential to access your content.

In my opinion, the simplest solution is provide user a log in page informing the user that they need to log in to view contents.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.