680104 - Unvouched profiles pages should show a friendly 403 (not a 500)

Status: VERIFIED FIXED

(Participation Infrastructure :: Phonebook, defect, P1)

Description

[Dave Dash [:davedash, :dd] (assign all bugs to mbrandt)]

Currently the 404 page we throw out isn't really accurate.  

404 is resource not found, but the resource is found, we're just not showing it.  So that implies that it's more along the lines of a 403 which seems harsh, but we can have a friendly message like:

this profile is not publicly viewable yet

CCing tofumatt for his opinion on status codes and whatnot.

Comment 1

[tofumatt [:tofumatt]]

Yes, the status code on this error/page should be 403, but it's a pretty important/specific scenario in terms of this app. It doesn't need to be a generic 403 page; what Dave suggests is spot-on.

The resource does exist; a 404 is wrong and uninformative, so let's make this change.

Comment 2

[Corey Shields [:cshields]]

Sorry, this does not throw a 404 but rather a 500...

the page itself exists but when unvouched, is not accessible to the public

Comment 3

[tofumatt [:tofumatt]]

This also happens with search; we should let people know why they aren't getting results when they search.

Comment 4

[Austin King [:ozten]]

I'm not sure about the STR, but...

This is by design to keep plausible deniability.

I should not be able to test for the existence of profiles.

Comment 5

[Corey Shields [:cshields]]

(In reply to Austin King [:ozten] from comment #4)
> I'm not sure about the STR, but...
> 
> This is by design to keep plausible deniability.
> 
> I should not be able to test for the existence of profiles.

I don't agree with this.

for one, the profile sign up page tells you explicitly to share the link.  If you then pull the link up in a browser without being logged in to an appropriate account, it throws the 500 error.  This is a mixed message to new users and can become confusing.

Secondly, plausible deniability shouldn't count here, unless the random profile ID (in my case, 1d05f8003a) can be decoded to user-identifiable data.

Comment 6

[Dave Dash [:davedash, :dd] (assign all bugs to mbrandt)]

> I don't agree with this.
> 
> for one, the profile sign up page tells you explicitly to share the link. 
> If you then pull the link up in a browser without being logged in to an
> appropriate account, it throws the 500 error.  This is a mixed message to
> new users and can become confusing.
> 
> Secondly, plausible deniability shouldn't count here, unless the random
> profile ID (in my case, 1d05f8003a) can be decoded to user-identifiable data.

+1

Even if we had user chosen usernames... going to /ozten and seeing that you have a profile that I can't see doesn't mean anything.

Comment 7

[Dave Dash [:davedash, :dd] (assign all bugs to mbrandt)]

Looks like we force login now.  

Makes sense.

Comment 8

[Tobias (:Tobbi) Markus]

Verified that trying to access a profile as anonymous forces you to log in.