When working with a resource-based site (such as an MVC application or REST service), we have two main options when a client tries to
GET a resource that they don't have access to:
- 403, which says that the client is unauthorized; or
- 404, which says that the resource does not exist (or couldn't be located).
Common wisdom and common practice seems to be to respond with the truth - that is, a 403. But I'm wondering if this is actually the right thing to do.
Secure login systems never tell you the reason for a login failure. That is to say, as far as the client is concerned, there is no detectable difference between a non-existent user name and an incorrect password. The purpose is of this is to not make user IDs - or worse, e-mail addresses - discoverable.
From a privacy standpoint, it seems a lot safer to return a 404. I'm reminded of the incident wherein someone reportedly found out the winners of a reality show (Survivor, I think) by looking at which resources didn't exist on the site vs. which ones did. I'm concerned about a 403 potentially giving away sensitive information like a serial number or account number.
Are there compelling reasons not to return a 404? Could a 404 policy have negative side effects elsewhere? If not, then why isn't the practice more common?