So I have different seniors taking different positions on this. Some saying hide nothing, those codes are there for a reason. Others saying to hide most status codes, reducing the number to a much smaller group (like only 400 and 404). Even RFC 2616 suggests a few substitutions are allowed (403 being treated as a 404 for a resource the web server will never deliver and will never explain why).
I'm not talking about the error page the user sees. Of course that should look nice for the user and should not dump a stack trace, ect. I'm talking about the http status included in the response. Meaning if they try to access a resource they aren't authorized for, instead of giving a 401/403, actually making the response be a 404 so that there is no way to know there was something there they weren't authorized for.
Is there a clear cut answer on which is the better practice (kinda like how it is best practice to not reroll your own password hashing)?