When a user requests a page that they don't have access to; should you return a 401 HTTP status code and a page to notify the user.

In the past I have worked under the idea thats bad practice, as when doing a security audit of a website gleaning information like this is a real page, you are just not authorized access it, is valuable information that could be exploited.

How should this be handled or is it just on a case by case basis?

  • I think you mean 403 access forbidden. 401 is for failed basicauth logins and other login related things (API). – Daniel Ruf Jan 15 '16 at 18:26
  • 401: Similar to 403 Forbidden, but specifically for use when authentication is required and has failed or has not yet been provided From wikipedia like. If the user in my case authenticated the request would be granted. So its a 401 not a 403 I believe – Snewedon Jan 15 '16 at 18:53
  • usually I just use 403, this is the same error code blocked clients get (deny rules). 401 is more interesting for attackers, you are right. – Daniel Ruf Jan 15 '16 at 18:57
  • In any case even if it was a 403 should the website confirm to the user that the link exists, in my case all it does it reveal to the user they have found out an encrypted id number – Snewedon Jan 15 '16 at 18:57

Sounds like you mean 403 forbidden, not 401 unauthorized (since you say authorized access, not authentication). This source explains it in better detail: Daniel Irvine

401 Unauthorized, the HTTP status code for authentication errors. And that’s just it: it’s for authentication, not authorization. Receiving a 401 response is the server telling you, “you aren’t authenticated–either not authenticated at all or authenticated incorrectly–but please reauthenticate and try again.” To help you out, it will always include a WWW-Authenticate header that describes how to authenticate.

Receiving a 403 response is the server telling you, “I’m sorry. I know who you are–I believe who you say you are–but you just don’t have permission to access this resource. Maybe if you ask the system administrator nicely, you’ll get permission. But please don’t bother me again until your predicament changes.”

I've never heard of a 401/403 status code being bad practice. In non-attack scenarios, it serves the important function of letting a user know that they need to request a privilege upgrade or go to somebody with higher privileges to complete some task. In many of these cases a user needs to know that the resource exists.

It does reveal to attackers that a resource does exist, potentially enlarging the attack surface of your app. However if you're depending on an attacker not knowing about a resource to keep it safe, you should probably improve the defenses around it instead. The usability advantages outweigh the slight security disadvantages.

  • "However if you're depending on an attacker not knowing about a resource to keep it safe, you should probably improve the defenses around it instead." Right, security by obscurity was never good. You should protect your website / app as good as possible and use a webapplication firewall and other tools to block malicious and unwanted requests. – Daniel Ruf Jan 15 '16 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.