Return 404 to hide 403's or 5xx's #13

New issue

Open

opened 2026-05-27 07:08:34 +02:00 by c.fahner · 0 comments

c.fahner commented

2026-05-27 07:08:34 +02:00

Owner

Currently, resources are free to return 403 or 5xx status codes when a permission error or internal error occurs. In production this would reveal information to a potential attacker.

The Resource\Handler should instead cast these status codes to generic 404 responses by default. Only when "debug mode" has been disabled from the configs or when the Resource has been explicitly marked as "public use" should the real response be shown.

Currently, resources are free to return 403 or 5xx status codes when a permission error or internal error occurs. In production this would reveal information to a potential attacker. The `Resource\Handler` should instead cast these status codes to generic 404 responses by default. Only when "debug mode" has been disabled from the configs or when the `Resource` has been explicitly marked as "public use" should the real response be shown.

c.fahner added the

Kind/Security

label

2026-05-27 07:08:34 +02:00