Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
When a user requests a page that they don't have access to; should you return a 401 HTTP status code and a page to notify the user.
In the past I have worked under the idea thats bad practice, as when doing a security audit of a website gleaning information like this is a real page, you are just not authorized access it, is valuable information that could be exploited.
How should this be handled or is it just on a case by case basis?
Sounds like you mean 403 forbidden, not 401 unauthorized (since you say authorized access, not authentication). This source explains it in better detail: Daniel Irvine
401 Unauthorized, the HTTP status code for authentication errors. And that’s just it: it’s for authentication, not authorization. Receiving a 401 response is the server telling you, “you aren’t authenticated–either not authenticated at all or authenticated incorrectly–but please reauthenticate and try again.” To help you out, it will always include a WWW-Authenticate header that describes how to authenticate.
Receiving a 403 response is the server telling you, “I’m sorry. I know who you are–I believe who you say you are–but you just don’t have permission to access this resource. Maybe if you ask the system administrator nicely, you’ll get permission. But please don’t bother me again until your predicament changes.”
I've never heard of a 401/403 status code being bad practice. In non-attack scenarios, it serves the important function of letting a user know that they need to request a privilege upgrade or go to somebody with higher privileges to complete some task. In many of these cases a user needs to know that the resource exists.
It does reveal to attackers that a resource does exist, potentially enlarging the attack surface of your app. However if you're depending on an attacker not knowing about a resource to keep it safe, you should probably improve the defenses around it instead. The usability advantages outweigh the slight security disadvantages.
