Change 404 to 403

Created on 10 May 2023, about 1 year ago

Problem/Motivation

I went with a 404 originally because I didn't want to disclose existence of nodes when you enable the module. However 403s have an advantage that you can set the error message and have the route name in it so that a user can add it simply to the list of routes if they users to access it. This usability improvement outweighs the security hardening of a 404.

Proposed resolution

Make the exception configurable and ensure the message on access denied is helpful.

Remaining tasks

User interface changes

New configuration

API changes

None

Data model changes

None

πŸ“Œ Task
Status

Fixed

Version

1.0

Component

Code

Created by

πŸ‡¬πŸ‡§United Kingdom alexpott πŸ‡ͺπŸ‡ΊπŸŒ

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.69.0 2024