Hi, On Tue, Jan 3, 2023 at 7:58 PM David Cook <dcook@prosentient.com.au> wrote:
It seems to me that we should just stop at “Authorization failure”. While it might be helpful for a dev to know what the required permissions are, I think it would also be overly helpful for an attacker to know what permissions are required too, no?
I don't feel strongly about it, but lean towards including the details for the sake of anybody trying to use the API. After all, the game is already up if the attacker is able to grant additional permissions to the service account. This may be a stretch, but another advantage of including the details is to reduce any temptation to assign the superlibrarian permission to a service account "just to get it working". Regards, Galen -- Galen Charlton Implementation and IT Manager Equinox Open Library Initiative gmc@equinoxOLI.org https://www.equinoxOLI.org phone: 877-OPEN-ILS (673-6457) direct: 770-709-5581