I'm developing an API for an application I'm working on and I've come across an interesting question:
Imagine an API endpoint like this:
GET /customers/123456
which returns a single customer object. Now, in our organization, customers can belong to sales organizations. Each API user is associated with an organization and I want to restrict a user's access to customers associated with their organization.
So, given a user who belongs to organization ABC
and customer 123456
who belongs to organization XYZ
, what should my API return when this user attempts to get that customer?
404 Not Found
- if a user queries a non-existent customer, it returns a404
since no resource was found at that URL.401 Unauthorized
- if you query a resource to which you do not have access, you should get an "unauthorized" response.
It seems to me that if the API returns 401 Unauthorized
or existing customers from other organizations and 404 Not Found
for non-existent customers, my API is leaking information. For example, a user from organization ABC
could query the API and determine which user IDs exist and which don't.
Additional notes:
Customer IDs are generated sequentially and there are no gaps, so the type of information that would be leaking would be:
- what will the next customer ID be?
- how many customers were created in a time period?
The sales organizations are generally restricted to particular geographic areas and are not usually in direct competition. But some territories do overlap and there are rules in effect to govern "poaching" each other's customers. So, all in all, it's a mildly competitive environment where we don't really want sales organizations to know about each other's clients.