Edit Question - KnowledgeHub

Title Body

Inspired by a thought while looking at the question " Correct HTTP status code when resource is available but not accessible because of permissions ", I will use the same scenario to illustrate my hypothetical question. Imagine I am building a a carpooling web service. Suppose the following GET /api/persons/angela/location retrieves the current position of user "angela". Only angela herself and a possible driver that is going to pick her should be able to know her location, so if the request is not authenticated to an appropriate user, a 401 Unauthorized response is returned. Also consider the request GET /api/persons/john/location when no user called john has registered with the system. There is no john resource let alone a resource for john's location, so this obviously returns a 404 Not Found . Or does it? What if I don't want to reveal whether or not john is registered with the system? (Perhaps the usernames are drawn from a small pool of university logins, and there is a very militant cycling group on campus that takes a very dim view of car usage, even if you are pooling? They could make requests to the URL for every user, and if they receive a 401 instead of 404, infer that the user is a car pooler) Does it make sense to return a 401 Unauthorized for this request, even though the resource does not exist and there is no possible set of credentials that could be supplied in a request to have the server return a 200?

Tags (comma-separated) Cancel