title: Is it OK to return a HTTP 401 for a non existent resource instead of 404 to prevent information disclosure?
body: <p>Inspired by a thought while looking at the question &quot;<a href="https://stackoverflow.com/q/3547474/445073">Correct HTTP status code when resource is available but not accessible because of permissions</a>&quot;, I will use the same scenario to illustrate my hypothetical question.</p>
  <p>Imagine I am building a a carpooling web service.</p>
  <p>Suppose the following</p>
  <pre><code>GET /api/persons/angela/location
  </code></pre>
  <p>retrieves the current position of user &quot;angela&quot;. Only angela herself and a possible driver that is going to pick her should be able to know her location, so if the request is not authenticated to an appropriate user, a <a href="https://www.rfc-editor.org/rfc/rfc2616#section-10.4.2" rel="nofollow noreferrer">401 Unauthorized</a> response is returned.</p>
  <p>Also consider the request</p>
  <pre><code>GET /api/persons/john/location
  </code></pre>
  <p>when no user called john has registered with the system. There is no john resource let alone a resource for john's location, so this obviously returns a <a href="https://www.rfc-editor.org/rfc/rfc2616#section-10.4.5" rel="nofollow noreferrer">404 Not Found</a>. Or does it?</p>
  <p><strong>What if I don't want to reveal whether or not john is registered with the system?</strong></p>
  <p>(Perhaps the usernames are drawn from a small pool of university logins, and there is a very militant cycling group on campus that takes a very dim view of car usage, even if you are pooling? They could make requests to the URL for every user, and if they receive a 401 instead of 404, infer that the user is a car pooler)</p>
  <p>Does it make sense to return a <a href="https://www.rfc-editor.org/rfc/rfc2616#section-10.4.2" rel="nofollow noreferrer">401 Unauthorized</a> for this request, even though the resource does not exist and there is no possible set of credentials that could be supplied in a request to have the server return a 200?</p>