News for hackers. Stuff that matters.
Re:Web servers should refuse requests for random, unnecessar... by tremon on Thursday July 06, 2023 @04:49PM (#36622784)
Returning a 200 response for a resource that doesn't exist is wrong

Isn't that just begging the question? What defines whether a resource exists? Is it the client's knowledge about the webserver backend configuration, or the server's? If a server returns a 200 response, the resource exists, by definition. It may or may not have data, but again, that's not up to the client to decide. If the server says the resource exists and has no data, then that's the authoritative answer.

There are no comments on this comment yet.