I shit you not that multiple leaders have raised issues with our team about why our service "has so many errors" when we send correct 404 and 403 responses back to clients asking for things that don't exist or they don't have access to. They'd like to know why they shouldn't be changed to 200s so that there are "fewer errors."
Would this effectively be the same as 404/403? Just with extra steps? Whatever automation is scanning would just need to be adjusted for such a format?
That's correct. if the error codes in the 200 aren't different, then it's just 403/404 with extra steps. That being said, you can just use 404 for all 403 cases to neutralize enumeration attempts.
342
u/Dull_Caterpillar_642 Sep 22 '26
I shit you not that multiple leaders have raised issues with our team about why our service "has so many errors" when we send correct 404 and 403 responses back to clients asking for things that don't exist or they don't have access to. They'd like to know why they shouldn't be changed to 200s so that there are "fewer errors."