| Summary: | Koha should return 403 when a feature is disabled | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Tomás Cohen Arazi (tcohen) <tomascohen> |
| Component: | Architecture, internals, and plumbing | Assignee: | Bugs List <koha-bugs> |
| Status: | NEW --- | QA Contact: | Testopia <testopia> |
| Severity: | enhancement | ||
| Priority: | P5 - low | CC: | dcook |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
|
Description
Tomás Cohen Arazi (tcohen)
2025-07-21 19:06:32 UTC
It's an interesting topic. I figure the options are probably 403 or 404, and I suppose both have pros and cons. Here are some that come to mind: 403 Pro: We admit the URL exists but the user can't use it Con: It suggests a permission issue when really the feature is just disabled 404 Pro: Since the feature is unavailable, we just say the URL is unavailable/not found Con: It suggests that the feature doesn't exist at all rather than it just can't be used With that in mind, I think that I probably agree with standardizing on 403. At least for now. If Koha were more modular and a module just wasn't installed, then 404 might make more sense. But since Koha isn't really modular in that sense... I think 403 works. |