Summary: | Koha should return 403 when a feature is disabled | ||
---|---|---|---|
Product: | Koha | Reporter: | Tomás Cohen Arazi (tcohen) <tomascohen> |
Component: | Architecture, internals, and plumbing | Assignee: | Bugs List <koha-bugs> |
Status: | NEW --- | QA Contact: | Testopia <testopia> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | dcook |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: |
Description
Tomás Cohen Arazi (tcohen)
2025-07-21 19:06:32 UTC
It's an interesting topic. I figure the options are probably 403 or 404, and I suppose both have pros and cons. Here are some that come to mind: 403 Pro: We admit the URL exists but the user can't use it Con: It suggests a permission issue when really the feature is just disabled 404 Pro: Since the feature is unavailable, we just say the URL is unavailable/not found Con: It suggests that the feature doesn't exist at all rather than it just can't be used With that in mind, I think that I probably agree with standardizing on 403. At least for now. If Koha were more modular and a module just wasn't installed, then 404 might make more sense. But since Koha isn't really modular in that sense... I think 403 works. |