Located here, RFC 7231 is all about the HTTP protocol (status codes)
I'm developing an in-house web application for my university's department and I'm at a (probably unimportant) impasse.
I'm reducing users' access to resources based on role (student, faculty, staff) and have it working just fine. However, when a user attempts to access a resource and is denied access, the HTTP specification says that I should use a 403: Forbidden
, marking that the user does not have access to the resource, or "hide" the resource by returning a 404: Not Found
.
I could do that, but I want to make the site a bit more user-friendly and instead redirect them to their previous page with a flash (NOTE that I did not say 'Adobe Flash'; see comments) message instead of having a 403/4
page with links back to different parts of the site. I think it's a pretty UX-friendly feature.
However, that would involve redirecting via a 303: See Other
, which more or less violates the standard.
Obviously it really doesn't matter as this is an in-house project for a lab at my university and nobody here is going to be complaining, but imagine this site were under the Google umbrella.
So, is it bad practice to deviate from the [HTTP] standard like this?
Edit: There seems to be a lot of confusion, so let me give an example:
User with id = 1
attempts to access mydomain.com/projects/2
through their profile (by clicking a link). User 1
is the owner of project 2
, so the server accepts the requests and renders the page with the project.
User 1
then types mydomain.com/projects/3
into the URL. User 1
is not the owner of project 3
. Therefore, when the request gets to the server, the server denies it.
Now, there are two options:
1.) The server redirects the user to /projects/2
(their previously visited page, which would of course always be a valid one) with a helpful notification at the top such as "Sorry, but you do not have permission to access XXXX" or
2.) The server renders a 403: Forbidden
page, or a 404: Not Found
page, which would probably have that same text (if it was a 403
), and maybe even a JavaScript-enabled "back" link
Personally, the redirect seems way more user friendly to me, and eliminates seeing an unfriendly page like 403: Forbidden
and having to click a "back" button. However, doing the redirect goes against the HTTP protocol standard.