Suppose user A creates a private resource at, for example,
If user B attempts to access the resource at
/books/somebooktitle what code should be returned?
HTTP403: Permission denied seems obvious BUT, does this not leak information to user B that someone has created a book and named that book with the title "somebooktitle"? That's two pieces of information that user B shouldn't technically be entitled to.
HTTP404: hides the fact that the book exists.
Is there best practice?