I'm developing an API for an application I'm working on and I've come across an interesting question:
Imagine an API endpoint like this:
which returns a single customer object. Now, in our organization, customers can belong to sales organizations. Each API user is associated with an organization and I want to restrict a user's access to customers associated with their organization.
So, given a user who belongs to organization
ABC and customer
123456 who belongs to organization
XYZ, what should my API return when this user attempts to get that customer?
404 Not Found- if a user queries a non-existent customer, it returns a
404since no resource was found at that URL.
401 Unauthorized- if you query a resource to which you do not have access, you should get an "unauthorized" response.
It seems to me that if the API returns
401 Unauthorized or existing customers from other organizations and
404 Not Found for non-existent customers, my API is leaking information. For example, a user from organization
ABC could query the API and determine which user IDs exist and which don't.
Customer IDs are generated sequentially and there are no gaps, so the type of information that would be leaking would be:
- what will the next customer ID be?
- how many customers were created in a time period?
The sales organizations are generally restricted to particular geographic areas and are not usually in direct competition. But some territories do overlap and there are rules in effect to govern "poaching" each other's customers. So, all in all, it's a mildly competitive environment where we don't really want sales organizations to know about each other's clients.