Merge pull request #2034 from l3montree-dev/fix/public-request-unauthorized

timbastin · web-flow · commit 4c872b690584 · 2026-05-21T12:39:11.000+02:00
fix: return 401 instead of 404 for disallowed public requests
diff --git a/middlewares/access_control_middlewares.go b/middlewares/access_control_middlewares.go
@@ -99,7 +99,7 @@ func DisallowPublicRequests(next echo.HandlerFunc) echo.HandlerFunc {
 	return func(ctx shared.Context) error {
 		if shared.IsPublicRequest(ctx) {
 			slog.Warn("access denied for public request in DisallowPublicRequests middleware")
-			return echo.NewHTTPError(404, "could not find resource")
+			return echo.NewHTTPError(401, "this endpoint is not accessible for public requests")
 		}
 		return next(ctx)
 	}

Original file line number	Diff line number	Diff line change
`@@ -99,7 +99,7 @@ func DisallowPublicRequests(next echo.HandlerFunc) echo.HandlerFunc {`
`99`	`99`	`return func(ctx shared.Context) error {`
`100`	`100`	`if shared.IsPublicRequest(ctx) {`
`101`	`101`	`slog.Warn("access denied for public request in DisallowPublicRequests middleware")`
`102`		`- return echo.NewHTTPError(404, "could not find resource")`
	`102`	`+ return echo.NewHTTPError(401, "this endpoint is not accessible for public requests")`
`103`	`103`	`}`
`104`	`104`	`return next(ctx)`
`105`	`105`	`}`