Bug 40461

Summary: Koha should return 403 when a feature is disabled
Product: Koha Reporter: Tomás Cohen Arazi (tcohen) <tomascohen>
Component: Architecture, internals, and plumbingAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dcook
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Tomás Cohen Arazi (tcohen) 2025-07-21 19:06:32 UTC
This should be an umbrella bug, unless there are no conflicting cases and we can solve them all in this report.

Picking `opac-export.pl` as an example, if there are no export formats enabled, the tool returns a 400. This status code means:

```
The HTTP 400 Bad Request client error response status code indicates that the server would not process the request due to something the server considered to be a client error. The reason for a 400 response is typically due to malformed request syntax, invalid request message framing, or deceptive request routing.
```

I propose we standardize on `403` [1]


[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/403
Comment 1 David Cook 2025-07-22 00:06:44 UTC
It's an interesting topic.

I figure the options are probably 403 or 404, and I suppose both have pros and cons. Here are some that come to mind:

403
Pro: We admit the URL exists but the user can't use it
Con: It suggests a permission issue when really the feature is just disabled

404
Pro: Since the feature is unavailable, we just say the URL is unavailable/not found
Con: It suggests that the feature doesn't exist at all rather than it just can't be used

With that in mind, I think that I probably agree with standardizing on 403. At least for now. If Koha were more modular and a module just wasn't installed, then 404 might make more sense. But since Koha isn't really modular in that sense... I think 403 works.