1

I have the following REST resources:

  • /companies returns the list of companies
  • /companies/{id} returns the company state
  • /companies/{id}/departments returns all the departments in a company
  • /employee/{id}/departments returns the departments an employee works in
  • /departments/{id} returns the department state

The thing to notice is that a department knows its associated companies and employees, but its URI does not contain this information. If the department does not exist, there is no way of knowing what company/employee it used to be associated with (or whether the resource ever existed at all). For the sake of argument, you should assume it is unlikely the department URI scheme will change (it's a long story).

The /companies resource has an associated query permission token. When a client references a non-existent company /companies/{id} I check whether they have access to query. If they do, I return HTTP 404 ("Not Found"), otherwise I return HTTP 403 ("Forbidden")

So far so good. The problem arises when a client references a non-existent /departments/{id} resource. Because the department does not exist, I can't figure out what company and query permission token it is associated with.

It seems we're back to the classic usability/security tradeoff:

  • Improve usability by assuming everyone has the right to know whether a resource exists (return a clear error message that indicates what went wrong), or
  • Improve security by returning a vague error code if a resource is missing or permission is denied (return a vague error message to hide whether a resource exists or permission is defined).

Is there another way?

1 Answer 1

0

I ended up dropping the query permission. Anyone can look up any resource if they know its address. Meaning, I don't try to prevent unauthorized users from finding out whether a resource exists or not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.