Right now, trying to access an RFD that one doesn’t have permission to access results in a generic 404 error. This is slightly unhelpful, but is often necessary to avoid leaking the existance of something. However, RFDs are (presumably) sequentially numbered.
If so, one can infer the existence of every RFD with a number ≤ that of the largest-numbered RFD one can view. This means that the information leak is not a concern. Therefore, it would be a bit more helpful to return an appropriate 401 or 403 error, indicating that one doesn’t have access.
This is not a major problem, merely a minor annoyance.
Right now, trying to access an RFD that one doesn’t have permission to access results in a generic 404 error. This is slightly unhelpful, but is often necessary to avoid leaking the existance of something. However, RFDs are (presumably) sequentially numbered.
If so, one can infer the existence of every RFD with a number ≤ that of the largest-numbered RFD one can view. This means that the information leak is not a concern. Therefore, it would be a bit more helpful to return an appropriate 401 or 403 error, indicating that one doesn’t have access.
This is not a major problem, merely a minor annoyance.