tomchristie/django-rest-framework — pull request #1332 by robbyt (2014-01-04 21:06:13+00:00)
Title: optionally throw a Http404 exception instead of a 403 when object-based permission fails

We would like to return 404s for some API endpoints to avoid "information leakage". By returning 404s for some objects, but 403 for others, it's possible for someone to scan our API, and find valid object names in the system.

Few notes about this pull request-

It's obviously "wrong" to return a 404 instead of a 403 for this sort of error, but Github does it so it can't be that bad! :+1:

Also, it's probably not great design. The current DRF code is very clean and easy to understand, but this leaks some implementation details into the views layer. However, I struggled to find a better place in DRF for this code to live.