Tag Info

New answers tagged

0

403, 404 and 401 which you didn't mention have specific meanings. 403 (forbidden) doesn't mean that this particular user isn't allowed to access the resource, but that nobody is. It has nothing to do with that particular user, and there is nothing the user can do to be allowed access. 401 (unauthorized) means that the user wasn't authorized to access the ...


0

I'm going to give a second answer, because looking back at what you wrote I think you might be asking a more basic question than I thought, one that deserves a very simple answer: Is it okay to return the “wrong” HTTP status code in order to show a more user-friendly error page? Yes. The HTTP specification does not say that web applications (such as ...


2

tl;dr - I second Basile's solution, and don't believe you've thought through the implications of your preferred 303 redirect. 1.) The server redirects the user to /projects/2 (their previously visited page, which would of course always be a valid one) with a helpful notification at the top such as "Sorry, but you do not have permission to access XXXX" ...


12

The protocol exists, there is a clear answer for what to do. This isn't anything super secret - it is an "in-house web application for my university's department." Do the thing that confuses your users and applications the least in the way that allows for proper expansion in a way that is also consistent. Consider the proposed page flow: User goes to ...


6

Don't be consumed by UX in these situations. A 403 or 404 code is extremely useful information to have. Some users may not understand it, but translating it into something else in a misguided attempt to make it user friendly is a bad idea. You need to show any 400 or 500 level error to users so the users can report them to you. If a user gets a 404, that's ...


2

It sounds like your use case is: When the user indicates they want to do XYZ, the browser sends a request to the server, which sends back a nice friendly reply page saying the user isn't allowed to do that. In that case, from the HTTP server's point of view, the request isn't forbidden. You can have the server reply with status 200 without ...


6

You might generate the error page (for 403: Forbidden HTTP error code). That error page might contain links to appropriate (context dependent) pages. I'm doing a similar thing on http://gcc-melt.org/ using my lev404cgi CGI program (free software GPL3+ licensed). Try opening http://gcc-melt.org/docu or http://gcc-melt.org/foobar; these are 404: Not found ...



Top 50 recent answers are included