Bug 40461 - Koha should return 403 when a feature is disabled
Summary: Koha should return 403 when a feature is disabled
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-07-21 19:06 UTC by Tomás Cohen Arazi (tcohen)
Modified: 2025-07-22 00:06 UTC (History)
1 user (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Tomás Cohen Arazi (tcohen) 2025-07-21 19:06:32 UTC
This should be an umbrella bug, unless there are no conflicting cases and we can solve them all in this report.

Picking `opac-export.pl` as an example, if there are no export formats enabled, the tool returns a 400. This status code means:

```
The HTTP 400 Bad Request client error response status code indicates that the server would not process the request due to something the server considered to be a client error. The reason for a 400 response is typically due to malformed request syntax, invalid request message framing, or deceptive request routing.
```

I propose we standardize on `403` [1]


[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/403
Comment 1 David Cook 2025-07-22 00:06:44 UTC
It's an interesting topic.

I figure the options are probably 403 or 404, and I suppose both have pros and cons. Here are some that come to mind:

403
Pro: We admit the URL exists but the user can't use it
Con: It suggests a permission issue when really the feature is just disabled

404
Pro: Since the feature is unavailable, we just say the URL is unavailable/not found
Con: It suggests that the feature doesn't exist at all rather than it just can't be used

With that in mind, I think that I probably agree with standardizing on 403. At least for now. If Koha were more modular and a module just wasn't installed, then 404 might make more sense. But since Koha isn't really modular in that sense... I think 403 works.