In recent months I have come across several sites, which give a 404 status/error page, when there should be 403 or maybe 401.

For example, I have a private repository on github.com with link:


When I accidentaly logged out and tried to reach this link, I only got "This is not the page you are looking for" message, which is obviously not true. I AM looking for it and the resource DOES exist, I am just not authenticated. I would expect a 403 or some other "permission denied" page. This one really scared me for a few seconds, because it implied my repository was deleted.

Do you also consider this to be wrong? What would be the "best practice" in this area?

  • My opinion is that when user is trying to reach authorized page, I would redirect him to login form and then, after authentication, if he had the rights to view the restricted content, I would redirect him back to his originally requested URL. Do you agree? – Vojta Hejda Jun 19 '15 at 12:24
  • "This is not the page you are looking for" - was this also accompanied by a 404 status? – MrWhite Jun 19 '15 at 16:00
  • I wonder if this is a new trend some developers are inventing to try to eliminate bad robots and if so, I wonder how well it works. – Mike -- No longer here Jun 19 '15 at 23:22
  • @w3d - There is 404 both as a header of that page and a status of the response. – Vojta Hejda Jun 22 '15 at 6:35

Personally I think this is justified. By returning a 403 instead, Github would be confirming that a repository with that name exists, which in itself could be seen as a security hole (or at least undesirable).

As a contrived example, imagine that these repositories existed:

If one day http://github.com/valve/HalfLife3 started returning a 403, that would basically confirm that Half Life 3 was being worked on.

The flip side of this is that it's not uncommon for web servers to be configured to serve 403s for non existent URLs, for the same reason.

  • Certainly a valid argument for a 404. However, I don't think it's necessarily always appropriate to send a 404 - it depends on the site. If you are serving a login prompt for unauthorised access then a 403/401 would be more appropriate. – MrWhite Jun 19 '15 at 16:10
  • Interesting, thank you. I was about to say that existance of the URL itself does not pose a security threat, since it doesn't give away the username of the owner, but your example somewhat justifies this. Even though I can't imagine someone, wanting to hide a secret project from the public, giving an exact name to the repository, instead of a code name. Anyway, would be interesting to hear from the GitHub devs, what is actually the reason for this :) – Vojta Hejda Jun 22 '15 at 6:39
  • Don't agree with this. It first should check if you have permissions to even know, if the repo exists or not. First Authorization, then 200 || 404 – nZeus Mar 10 '20 at 8:43

Well, 404 should be used when the resource do not exist, is not that you're not authorized, it is not there at all. 403 should be for forbidden resources, regardless you're authenticated, you might not have permission over a given resource. I rather 401 for resources that are found but requires some sort of authentication to get it. IMO

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.