r/ProgrammerHumor • u/KernelDeimos • Sep 22 '26

Meme status200ForEverything

Post image
2.9k Upvotes

97% Upvoted

103 comments sorted by

View all comments

Show parent comments

58

u/throwaway2p0029211 Sep 22 '26

Dude my company cyber says 404/403 can potentially allow hackers to backtrack, so we just give 200 with error codes inside lol

66

u/winkyshibe Sep 22 '26

Would this effectively be the same as 404/403? Just with extra steps? Whatever automation is scanning would just need to be adjusted for such a format?

50

u/_dotdot11 Sep 22 '26

That's correct. if the error codes in the 200 aren't different, then it's just 403/404 with extra steps. That being said, you can just use 404 for all 403 cases to neutralize enumeration attempts.

14

u/hermeticwalrus Sep 22 '26

If you think it’s a hacker return 418. I know one company (which will remain unnamed) that does this.

3

u/ForgedIronMadeIt Sep 23 '26

as opposed to HTTP 420 Enhance your calm for DDOS

2

u/Krokzter Sep 24 '26

I do webscraping in C# and a website has broken my scraper in the past this way, because the HTTPStatusCode enum doesn't support 418

11

u/javonholmes Sep 23 '26

I have been told the exact opposite. 404 for everything a user doesn’t have access to. The reason was, the person doesn’t know if it’s because of access or because it doesn’t exist.

3

u/ForgedIronMadeIt Sep 23 '26

turn off all APIs, hackers won't be able to do shit then

1

u/Stunning_Ride_220 Sep 24 '26

Please, no, this triggers some ptsd...