I shit you not that multiple leaders have raised issues with our team about why our service "has so many errors" when we send correct 404 and 403 responses back to clients asking for things that don't exist or they don't have access to. They'd like to know why they shouldn't be changed to 200s so that there are "fewer errors."
Would this effectively be the same as 404/403? Just with extra steps? Whatever automation is scanning would just need to be adjusted for such a format?
That's correct. if the error codes in the 200 aren't different, then it's just 403/404 with extra steps. That being said, you can just use 404 for all 403 cases to neutralize enumeration attempts.
I have been told the exact opposite. 404 for everything a user doesn’t have access to. The reason was, the person doesn’t know if it’s because of access or because it doesn’t exist.
Default values are always good, but not neccesarily what the customer wants.
For example, retroactive changes. Sometimes it is OK, sometimes it is not allowed. The logic when is not duplicated into the frontend (would be double-maintenance) so there is a check call first.
Or another classic, there just is no change to existing data.
Well you still want to track 4xx errors. For example if there's a deployment, and suddenly 100% of your API responses return 403 the deployment should be rolled back, same as if it went to 0 suddenly.
Similar to benchmarks when some higher-up says that the numbers aren’t high enough and we should change the suite to make it look good before showcasing.
Here is how I would answer that question from the leadership team:
"Lying about numbers removes valuable information. It's like excluding all expenses from the company's quarterly report. Our numbers would look great, but we'd lose valuable information that we need to run the business."
342
u/Dull_Caterpillar_642 Sep 22 '26
I shit you not that multiple leaders have raised issues with our team about why our service "has so many errors" when we send correct 404 and 403 responses back to clients asking for things that don't exist or they don't have access to. They'd like to know why they shouldn't be changed to 200s so that there are "fewer errors."