Located here, RFC 7231 is all about the HTTP protocol (status codes)
I'm developing an in-house web application for my university's department and I'm at a (probably unimportant) impasse.
I'm reducing users' access to resources based on role (student, faculty, staff) and have it working just fine. However, when a user attempts to access a resource and is denied access, the HTTP specification says that I should use a
403: Forbidden, marking that the user does not have access to the resource, or "hide" the resource by returning a
404: Not Found.
I could do that, but I want to make the site a bit more user-friendly and instead redirect them to their previous page with a flash (NOTE that I did not say 'Adobe Flash'; see comments) message instead of having a
403/4 page with links back to different parts of the site. I think it's a pretty UX-friendly feature.
However, that would involve redirecting via a
303: See Other, which more or less violates the standard.
Obviously it really doesn't matter as this is an in-house project for a lab at my university and nobody here is going to be complaining, but imagine this site were under the Google umbrella.
So, is it bad practice to deviate from the [HTTP] standard like this?
Edit: There seems to be a lot of confusion, so let me give an example:
id = 1 attempts to access
mydomain.com/projects/2 through their profile (by clicking a link). User
1 is the owner of project
2, so the server accepts the requests and renders the page with the project.
1 then types
mydomain.com/projects/3 into the URL. User
1 is not the owner of project
3. Therefore, when the request gets to the server, the server denies it.
Now, there are two options:
1.) The server redirects the user to
/projects/2 (their previously visited page, which would of course always be a valid one) with a helpful notification at the top such as "Sorry, but you do not have permission to access XXXX" or
2.) The server renders a
403: Forbidden page, or a
404: Not Found page, which would probably have that same text (if it was a
Personally, the redirect seems way more user friendly to me, and eliminates seeing an unfriendly page like
403: Forbidden and having to click a "back" button. However, doing the redirect goes against the HTTP protocol standard.