Re:I've been abusing HTTP Status Codes in my APIs for years
by wizofaus on Wednesday July 13, 2022 @11:12AM
(#32083794)
Wait - it's exactly the "random clients... poking around" that I'd want the alerts for!
404s occurring due to intentional but broken requests is fine - the caller will know about it and deal with it as necessary.
But either way, it is a reasonable argument in favor of not using 404 in the case an endpoint was matched but the specific resource id/path was not. It's not entirely dissimilar to the distinction between "file not found" and "directory not found".
[ Parent
| on HN ]
Re:I've been abusing HTTP Status Codes in my APIs for years
by shadowgovt on Wednesday July 13, 2022 @02:26PM
(#32086803)
If you alert on 404s to URLs that nobody should expect to exist, you create a vector by which malicious actors can wake up your oncall staff at 3AM. That's probably not something you want to do to your oncall staff.
Re:I've been abusing HTTP Status Codes in my APIs for years
by wizofaus on Wednesday July 13, 2022 @03:17PM
(#32087530)
Depending on what sort of service you're running that might actually be justifiable, but I wasn't assuming a threshold breach for 404s would be waking people up in the middle of the night.
At any rate, any such alert is always somewhat vulnerable to that problem, regardless of how the error codes are being triggered. Sounds more hypothetical than likely-in- practice.