0

I've the endpoint POST /permission-period which should create a permission period for a specific user.

The payload:

{
    "userId": 10,
    "permissionPeriodDateFrom": "2017-12-01",
    "permissionPeriodDateTo": "2017-12-10"
}

If any property from the payload is invalid, i usually return 422 Unprocessable Entity, which means the syntax of the request payload is valid but it cannot be processed due to invalid data.

What status should I return if the user does not exist and I do not want to provide the client with this security related information? Should i expose the message that the user does not exist or not?

1 Answer 1

1

I think HTTP status code wise I would choose a 400 - Bad request. Regarding the returned error message I would give the user a helpful information while keeping security-related information secret.

You could return something like The given userId is either malformed, does not exist or cannot be linked to the posted resource. This would allow the user to identify the spot where in the body the error comes up (property userId) but does not tell him the exact error to prevent user enumeration.

The good news is that you obviously have a protected endpoint when creating a permission-period so the API user is identifiable and you can take other actions for preventing user enumeration and related brute force attacks such as consumer-based throttling or locking the API consumer after x attempts.

I hope my notes help you with your API design.

2
  • Thanks for your help. And if I have an endpoint /user/{id} where the ressource can be accessed through a slug? Should i return then 404?
    – ProV
    Commented Aug 2, 2020 at 15:55
  • Yes, when you call the resource directly and it is not found/does not exist, you should return 404. When only a reference within the body or any other parameters do not exist (as in your question) I would prefer 400 as the called resource POST /someurl actually exists, so 404 would not be correct in this case
    – Philipp
    Commented Aug 3, 2020 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.