I am designing an authorization framework and now I am thinking about the error codes which I should return when someone is trying to access a resource and he doesn't have the required permissions. These are my thoughts so far:
case: The user is not authenticated, he is seen as "anonymous" -> Here I think 401 would be the right status code, so the user gets the opportunity to authenticate itself.
case The user is already authenticated. I would return 404 NOT FOUND. RFC2616 states that if we don't want to reveal exactly why the request has been refused, 404 is a good way to go.
I am also thinking to ad another case for the user: ADMIN. If ADMIN is unauthorized he should get customized responses, so he would know exactly what the problem is. What do you think about this? Does it make sense? How could someone exploit this?
Do you think that it is better to use 404 for everything or would you differentiate between 403 and 404, and why?
Is there any good literature regarding this subject? (I have already searched and found nothing conclusive)