beginner · http

403 or 404?

A user requests a resource that exists but they may not access it — 403 or 404? Why might you choose either?

Practical scenario

A multi-tenant API returns 403 for other tenants' order ids and 404 for nonexistent ones, and a pentest report shows order volume can be inferred by scanning ids.

What it tests

  • • Understanding that status codes leak information
  • • Consistency as a contract property
  • • Judgment over rule-following