Should phx.gen.auth return 401s

[garrison]

@BartOtten

True. But it is still information: that the requested resource does not exist.

No, it does not confer that either. I suppose you could say it confers “this website has a 404 template”, if you wanted to.

@BartOtten

This was not the point. The point is if we should fake ‘non existent’ or use the standard response code “403: you are not authorized to access the resource” (or 401: you are not authorized at all, regardless of the specific resource)

But the problem, as discussed with the git example, is that some routes are public unless you don’t have access. So if you try to load up a public repo you can see it, but if you load a private repo it has to 404. If you 401 for the private route then you admit that it exists.

You could instead return 401 for repos that actually don’t exist, but that is even more confusing!

[BartOtten]

The 404 (Not Found) status code indicates that the origin server did not find a current representation for the target resource or is not willing to disclose that one exists.

RFC 9110: HTTP Semantics

Should read RFC updates at breakfast. Settles it: 404 is okey. Also “current representation”

[garrison]

Huh, the more you know. Did they add that at some point or was it there the whole time?

[BartOtten]

It’s added at some point.

the explicit acknowledgment that a server might intentionally hide the existence of a resource by returning a 404 status code was first documented in RFC 7231.​

2014 it issss. Guess it is not known to many. Look at this thread and even my eating RFC’s for breakfast colleague missed it.

[BartOtten]

Answer to the question: no, 404 is fine.

Case closed.