"The requested resource was not found" with 404 instead of 403

CyberGene

I have created a tag on my forum that has a permission: only registered users can view these discussions. When one is browsing anonymously the forum and clicks on a link to such a discussion (for instance the auto-generated post that links to another discussion when moving posts), then a red error message appears in the lower-left corner "The requested resource was not found" and 404 can be observed in the browser console. Also, a spinner is shown indefinitely on the screen.

I think that's a Flarum bug. The proper error should be "403 unauthorized", instead of "404 not-found". Also, instead of a floating error and an infinite spinner, a proper error page should be shown informing the user that he is not authorized to view that discussion.

Furthermore, there's a similar error when the tag permission is set to be viewable only by a particular user group and a logged-in user not belonging to that group tries to open a link to such a discussion. This time we have a static error page but again it's 404 which is misleading, instead of 403 and a proper message that informs the user that he is not authorized to view that discussion.

P.S. I'm wondering if it might also be a good idea, in the case an anonymous user encounters 403, to forward to the login page, or show an error and put a link to the login page.

GreXXL

CyberGene I cannot confirm this. I just tested this here on discuss and correctly received a 404 error when requesting a resource that exists but doesn't have permission to access. Can you share your php flarum info output? Maybe you are having the error because of an installed extension.

CyberGene

GreXXL I cannot confirm this. I just tested this here on discuss and correctly received a 404 error when requesting a resource that exists but doesn't have permission to access.

Well, that’s the issue. It should be 403 (unauthorized) and not 404 (not found). But @clarkwinkelmann has provided some reasoning as to why that is intentional. I don’t necessarily agree but I will see if I can use his other suggestion.

clarkwinkelmann you might be able to use my See Past First Post extension to achieve what you need

I’ll check it out, thanks!

clarkwinkelmann

The 404 error is definitely a feature and not a bug. It's intentionally designed this way to prevent enumerating hidden discussion.

I agree with the full page error and login suggestion, this has been discussed before and just not implemented yet. But by default I believe the error should remain identical for invalid and unauthorized to prevent exposing any information.

Extensions could of course change the error page. In fact you might be able to use my See Past First Post extension to achieve what you need. The extension has an option to hide all posts from a discussion, so clicking a link will render an empty post stream with a suggestion to login or switch account.

CyberGene

@clarkwinkelmann I checked the See Past First Post extension and tested it on a copy of my forum and it's actually pretty useful and I might use it for some of my discussions, however I don't like that the discussion titles are still visible to non-logged users, and also the requirement not to tag the discussions with other tags that would override the limited visibility.

With that in mind, is there an easy way to customize the default 404 error message?

Currently it's:

The page you requested could not be found.

Return to ... Forum

Is there an easy way to customize that text to something like:

The page you requested could not be found, or you may have to be logged in or authorized to see it.

GreXXL

CyberGene you could use https://discuss.flarum.org/d/10784-friendsofflarum-custom-html-error-pages to modify the error pages.