[Bug 40461] New: Koha should return 403 when a feature is disabled
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40461 Bug ID: 40461 Summary: Koha should return 403 when a feature is disabled Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: tomascohen@gmail.com QA Contact: testopia@bugs.koha-community.org This should be an umbrella bug, unless there are no conflicting cases and we can solve them all in this report. Picking `opac-export.pl` as an example, if there are no export formats enabled, the tool returns a 400. This status code means: ``` The HTTP 400 Bad Request client error response status code indicates that the server would not process the request due to something the server considered to be a client error. The reason for a 400 response is typically due to malformed request syntax, invalid request message framing, or deceptive request routing. ``` I propose we standardize on `403` [1] [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/403 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40461 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40461 --- Comment #1 from David Cook <dcook@prosentient.com.au> --- It's an interesting topic. I figure the options are probably 403 or 404, and I suppose both have pros and cons. Here are some that come to mind: 403 Pro: We admit the URL exists but the user can't use it Con: It suggests a permission issue when really the feature is just disabled 404 Pro: Since the feature is unavailable, we just say the URL is unavailable/not found Con: It suggests that the feature doesn't exist at all rather than it just can't be used With that in mind, I think that I probably agree with standardizing on 403. At least for now. If Koha were more modular and a module just wasn't installed, then 404 might make more sense. But since Koha isn't really modular in that sense... I think 403 works. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org