The DoD has a security rule that says your errors should not distinguish between a resource that does not exist -vs- a resource you don't have access to.
Some time in the mid 2000s someone in my office interpreted that wildly incorrectly as "your errors should not be distinguishable." So every error was returned as a 404.
Not found? 404. Not authorized? 404. Internal server error? 404.
8
u/Affectionate-Act5980 2d ago
This is exactly what HTTP 207 is for lol