1

Let's consider the following scenario. I need to access a resource hosted on server X. I want to get this resource in a Y format, so along with my request I send the Accept: Y header. Unfortunately X does not support Y and I'm not not allowed to access the resource on X as well. I've included valid Authorization header.

How should X reply? With a 415 - telling me that it cannot talk to me in a requested format or 403 (with some body that I probably cannot read because the body parser I use supports only Y format).

|improve this question
5

From a security viewpoint, you want to disclose as little information as possible to an attacker.

By responding with a 415 code until they hit a supported format and sending a 403 then, you are giving an attacker a mechanism to figure out which formats are supported.

If you always reply with a 403, then an attacker can't tell if there are additional reasons why the request might fail, such as an unsupported format.

|improve this answer
  • Ok, and from HTTP point of view? – Opal Oct 2 '19 at 10:58
  • 1
    @Opal, to my knowledge, HTTP does not care. – Bart van Ingen Schenau Oct 2 '19 at 11:02
  • That's why I'm asking. Because I think that HTTP does care. I have no idea why today we use the protocol and disobey its rules. – Opal Oct 2 '19 at 11:12
  • @Opal, I checked the HTTP specification and it doesn't mention a priority order of response codes. It does not even acknowledge that a server might have to choose between several appropriate codes. – Bart van Ingen Schenau Oct 2 '19 at 11:35
  • 3
    @Opal, it is kinda hard to give a reference to something that doesn't exist. The closest I can give you is the section on status codes. – Bart van Ingen Schenau Oct 2 '19 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.