When to display "Record Not Found" Page or return HTTP 404?

Question

I am sure people have many different opinions on this.
I want to know how other developers think about handling this scenario.

Pre-Condition

The web application/service requires authentication (i.e., the user needs to be logged in).
It is not publicly accessible.

---

Web Application Scenario

Example URL: ~/PurchaseOrder/View/1234

1. Purchase Order record does NOT exist in the database.
2. Purchase Order record exists, but the user does NOT have permission to view due to some business requirements.

How do you decide between the following two options:

• Display Purchase Order Not Found web page with HTTP 200.
• Sets the response status to HTTP 404 Not Found and redirect to a generic 404 error page.

---

Web Service API Scenario

Lets say the Purchase Order record is retrievable from a web service in JSON format.
Obviously, the API would return HTTP 404 if the record does not exist.

But how should it respond when the user does not have permission to view that particular Purchase Order record? Sets response code to 404 and return an error message in JSON???

Thanks!

Answer 1

For a REST web service API, return 404 if the record is not found. If the user does not have permission, return 403 "Forbidden" if you want to make it known that the record exists but the user does not have permission. Return 404 if you do NOT want to disclose the fact that the record exists when the user does not have permission to view it.

From the HTTP spec:

10.4.4 403 Forbidden

The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. If the server does not wish to make this information available to the client, the status code 404 (Not Found) can be used instead.

For the web application scenario, it is probably more technically correct to return a 404 (or 403) along with a friendly error page in the body of the response in case of an error, but returning a 200 may result in a better user experience, depending on what browsers your audience is using. (I have heard of problems with some old browsers ignoring the custom error page with a 4xx error and instead displaying their own internal error page, whereas they will always display the content of a 200 response. Modern browsers should not have this problem though.)