News for hackers. Stuff that matters.
Re:Web servers should refuse requests for random, unnecessar... by wang_li on Thursday July 06, 2023 @01:35PM (#36619733)
>However, 200 (success) is simply wrong.

What makes it wrong? HTTP/HTTPS URLs/URIs don't mean files on the disk. You can return 200 as a default if you like.

Re:Web servers should refuse requests for random, unnecessar... by shkkmo on Thursday July 06, 2023 @02:46PM (#36620849)
Returning a 200 response for a resource that doesn't exist is wrong.

The correct response code would be a 3XX or 4XX response code, depending on the client behavior that you want.

In this specific case, a 303 response that redirects to the homepage would be most correct.

Alternatively, you could return a 404 response alongside the default content.

Re:Web servers should refuse requests for random, unnecessar... by phlakaton on Thursday July 06, 2023 @03:20PM (#36621378)
And how do you know the resource doesn't exist in this case? The server says it does.

The point is, "resource" is an abstraction that servers may implement as they wish. The only requirements, per HTTP, is that (1) it's something that can be identified with a URI (satisfied in this case), and (2) it has information associated with it that can be retrieved and/or managed via the HTTP protocol (satisfied in this case).

We might imagine that the set of resources should be finite, or strictly mapped to extant data records in our system – but these are not requirements.

Re:Web servers should refuse requests for random, unnecessar... by cellularmitosis on Thursday July 06, 2023 @03:35PM (#36621589)
We can argue about the semantics of "wrong" all day, but the lesson here is that not following standards and conventions creates extra work for everyone downstream.
Re:Web servers should refuse requests for random, unnecessar... by moring on Friday July 07, 2023 @06:59AM (#36629899)
They followed the standard though. They returned 200 for a resource that exists.

Many responses here seem to be based on the misunderstanding that this is about "not following a standard is sometimes okay-ish", when it's actually about the fact that the standard does not rigorously define what a "resource" is and what it means for the resource to "exist", other than a circular definition based on status codes.

Re:Web servers should refuse requests for random, unnecessar... by cellularmitosis on Friday July 07, 2023 @11:22AM (#36633104)
Serving an identical resource at all possible paths is no one's idea of following established conventions. That's what redirects are for.
Re:Web servers should refuse requests for random, unnecessar... by phlakaton on Saturday July 08, 2023 @02:56AM (#36642022)
Is it an identical resource? How do you know? But let's say they are identical. Where in the HTTP spec does it say identical resources may not be served at different endpoints? Nowhere, of course.

You talk about violating conventions and standards. The conventions are defined by the HTTP spec. The standard is the HTTP spec. Neither are, so far as I can tell, being violated here.

Re:Web servers should refuse requests for random, unnecessar... by shkkmo on Thursday July 06, 2023 @03:26PM (#36621454)
> We might imagine that the set of resources should be finite, or strictly mapped to extant data records in our system – but these are not requirements.

Clearly they aren't requirements as I can think of many valid use cases that violate them.

To me, creating an infinite number of identical aliases for a single resource is clearly wrong. The only reason to do it is either incompetence or laziness.

Re:Web servers should refuse requests for random, unnecessar... by eddythompson80 on Thursday July 06, 2023 @03:26PM (#36621448)
> depending on the client behavior that you want.

What if you want to confuse the client?

Re:Web servers should refuse requests for random, unnecessar... by pravus on Thursday July 06, 2023 @03:25PM (#36621443)
URLs refer to resources, not files.
Re:Web servers should refuse requests for random, unnecessar... by tremon on Thursday July 06, 2023 @04:49PM (#36622784)
Returning a 200 response for a resource that doesn't exist is wrong

Isn't that just begging the question? What defines whether a resource exists? Is it the client's knowledge about the webserver backend configuration, or the server's? If a server returns a 200 response, the resource exists, by definition. It may or may not have data, but again, that's not up to the client to decide. If the server says the resource exists and has no data, then that's the authoritative answer.

Re:Web servers should refuse requests for random, unnecessar... by toast0 on Thursday July 06, 2023 @05:14PM (#36623162)
> The correct response code would be a 3XX or 4XX response code, depending on the client behavior that you want.

If the client behavior you want is to display your styled error page, that has historically meant returning a 200 status code, because some user-agents prefer their own error displays.

Re:Web servers should refuse requests for random, unnecessar... by dekhn on Thursday July 06, 2023 @04:57PM (#36622909)
I had to look this up recently, but Tim Berners Lee specifically said that URIs should be treated more or less identically to files on disk. That would mean that accessing a web server that is hosting a static directory should return not found for missing files. But this was just a guideline and it was never followed in practice.
Re:Web servers should refuse requests for random, unnecessar... by lifeonlars on Friday July 07, 2023 @04:29AM (#36628874)
How the web works has changed quite a lot since the early 1990s though.
Re:Web servers should refuse requests for random, unnecessar... by mock-possum on Thursday July 06, 2023 @05:59PM (#36623711)
RFC 9110 - https://httpwg.org/specs/rfc9110.html#overview.of.status.cod...

It’s like saying “what makes it wrong to signal left but turn right?”

It makes the component you’re operating behave less predictably, resulting in a less stable system overall. Follow the spec.

Re:Web servers should refuse requests for random, unnecessar... by moring on Friday July 07, 2023 @07:01AM (#36629914)
They followed the spec though. They returned 200 for a resource that exists.

> It’s like saying “what makes it wrong to signal left but turn right?”

No, it's not like that. Signalling left but turning right would be like returning a 200 for a resource that does not exist.