Consistency of 403, 404 and 405

[l***@gmail.com]

Hi there!

I was trying to determine the official order in which 403, 404 and 405
should be returned in the cases where more than one error is applicable.
I asked this failed question in
stackoverflow https://stackoverflow.com/questions/50805614/order-in-which-http-error-codes-403-404-and-405-should-be-expected
and deleted because I
found https://stackoverflow.com/questions/942951/rest-api-error-return-good-practices
. There is an answer, not the accepted one, that explains it really nice.

I am looking at this graphic now: Loading Image...
From it, 403 comes first, then 404 and lastly 405.

I am implementing custom permission class. has_object_permission is
returning 404 before 403 for obvious reasons, the error 404 is raised in
get_object before has_object_permission is even called.

Is this by design?
Can we rethink this and find a way to always call has_object_permission
with obj=None so that 403 is raised before?

[Tom Christie]

to always call has_object_permission with obj=None so that 403 is raised

before

I don't understand the logic there. Object permissions apply to instances
(not to non-existent `None` instances).
If you want to prevent visibility onto existence-of-instances, then you
should apply the usual endpoint-based permissions.

[l***@gmail.com]

I have a weird use case where I must return owned instances, and 403
otherwise (for both not owned yet existing, and non existing.) The way I
see it, I need to handle this in has_object_permission. I could tweak the
API so that the owner is prefixed in the url and then deal with it endpoint
based, but wanted to know if there was a way to keep the url owner
agnostic. Thanks!