Re:I've been abusing HTTP Status Codes in my APIs for years
by shadowgovt on Wednesday July 13, 2022 @02:26PM
(#32086803)
If you alert on 404s to URLs that nobody should expect to exist, you create a vector by which malicious actors can wake up your oncall staff at 3AM. That's probably not something you want to do to your oncall staff.
[ Parent
| on HN ]
Re:I've been abusing HTTP Status Codes in my APIs for years
by wizofaus on Wednesday July 13, 2022 @03:17PM
(#32087530)
Depending on what sort of service you're running that might actually be justifiable, but I wasn't assuming a threshold breach for 404s would be waking people up in the middle of the night.
At any rate, any such alert is always somewhat vulnerable to that problem, regardless of how the error codes are being triggered. Sounds more hypothetical than likely-in- practice.