2

Issue: Some pages return a 404 'Page not found' when, actually, they're there but a user doesn't have access. It's very confusing that these links appear in these 'help for newbies'-type pages, and means this confusion will certainly be repeated because no sensible message is shown to the user upon arrival at a 'not found' page.

Example: At the foot of the "Approve or reject tag wiki edits" privileges help page, under the "Vote on suggested edits" section, the link "suggested edits tab in the review section" appears broken.

Possible solutions: This is not good from a usability standpoint on an otherwise excellent site, and breaks internet standards. The 'correct' behaviour would be to either:

  • Throw a 403 with a nice, friendly, "You don't have the required level of reputation to be able to use this page," with links to help/FAQs.
  • Don't throw a 404 or a 403 and just change the 'Suggested Edits' report page and show a friendly message to users without that privilage.
  • Ensure links to such advanced pages are not available to 'newbies'

I can accept that Stack Exchange might want to not 'advertise' pages that exist for only a select few, but at the same time when logged in as an active member, one would hope to be receive an explanation rather than an error message.

Could this situation be fixed, or the logic behind this behavior explained please?

2
  • As a side note, I think you should let your original question first and then put the following edit, it's less confusing when you read it for the first time.
    – tostinni
    Dec 27, 2011 at 15:20
  • Done, thanks... Any chance of a +1 on the question so it gets some attention? Thanks!
    – Jim Kirkpatrick
    Jan 7, 2012 at 19:39

3 Answers 3

Reset to default
1

There's a few things to unpack here:

Whether this has to be asked on Meta Stack Overflow

This isn't necessary. Stack Exchange reviews all the child meta discussion sites: you are fine asking questions about stuff that happens on Drupal Answers, even if what happens here also affects other sites.

Meta Drupal Answers shouldn't just be the constant retag fest it currently is, and every user should feel free to discuss things related to Drupal Answers, whether it only affects this site or it affects multiple sites.

Using 403 Forbidden over 404 File Not Found

This is a common misconception of HTTP 4xx status codes: in this situation, 403 Forbidden is always incorrect, and 404 File Not Found is actually the closest error to reality.

I explained a bit more about the difference between 403 and 404 in an answer on Programmers, but in short, 403 Forbidden is the server saying "I understand the request, but I will not handle it now or in the future, so stop trying" whereas 404 File Not Found is "this page isn't available to you now, but it may be available in the future."

Preventing discovery of links not accessible to a user

The purpose of the privileges page is discovery: you want people to see what extra reputation gives them and what they can do when they hit certain milestones. You're going to have to talk about things that users cannot access, and provide links to that stuff for the people who can.

Now, they could write two separate pages: one for when you have the reputation and one for when you're aspiring to get to that reputation, but that's a maintainability nightmare.

The other option is to disable the links for those who don't have access, but this goes against one of the main design principles of the network: to not show disabled links. Joel Spolsky, one of the founders of Stack Overflow and Stack Exchange, once wrote:

A long time ago, it became fashionable, even recommended, to disable menu items when they could not be used.

Don't do this. Users see the disabled menu item that they want to click on, and are left entirely without a clue of what they are supposed to do to get the menu item to work.

Instead, leave the menu item enabled. If there's some reason you can't complete the action, the menu item can display a message telling the user why.

So you're left with leaving the links there and throwing an error when a user who can't access it does so. Which brings us to your other suggestion...

Provide a better error message for users who hit those pages

This I'm 100% with you on, and there's definitely precedent that Stack Exchange would do it:

Perhaps something like:

This page is not available for your reputation. Please see the privileges page to see how much reputation you need to unlock it.

2
  • Thanks Mark. I understand and largely agree. The only nit-pick is the 403 thing: I accept that HTTP describes specific behaviour protocols, but that behaviour (over the years) has been integrated and extended by the software... Specifically, Drupal - the CMS that brought us all here in the first place! - uses 403s for precisely this "you can't because you don't have permission" kind of behaviour. Thanks for a very helpful response mate.
    – Jim Kirkpatrick
    Dec 26, 2011 at 20:11
  • @JimKirkpatrick drupal_access_denied(), in the core API at least, is used in a different way than it is used here on Stack Exchange: it's mostly used when Drupal page callbacks are passed incorrect data versus Stack Exchange's "you don't have access to this page yet". Although it'd be interesting find the rationale for using 403 over more appropriate status codes.
    – user7
    Dec 27, 2011 at 19:37
1

https://drupal.stackexchange.com/review/suggested-edits is the correct URL; if you get a 404 error is just because you don't have the privilege of reviewing the suggested edits, which in fact would require you to have a reputation of at least 5000, while your reputation is just 532.
Stack Exchange doesn't return a 403 error when you have the permission to see a page; you can verify that by looking at https://drupal.stackexchange.com/tools?s=1; I can access that page, but you would get a 404 error, instead of a 403 error.

I checked in other SE sites, and the link is for /review/suggested-edits.

Looking at the RFC 2616 text, you can notice the following sentences:

10.4.4 403 Forbidden

The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. If the server does not wish to make this information available to the client, the status code 404 (Not Found) can be used instead.

Reading that, I would take that if the server is not going to make public the reason of the error (e.g. you don't have the privilege necessary to see the page), it could return the 404 error code, and that is something the RFC suggests doing.

4
  • OK understood... but that's still broken behaviour. A 404 means 'Page not found', what I should have got is a 403 'access denied' page OR a 'normal' (200) page with a sensible message that explains this.
    – Jim Kirkpatrick
    Dec 24, 2011 at 13:46
  • 1
    That is what Stack Exchange does; I guess that returning a 403 error would reveal that the URL takes to an existing page, while they want to hide that. You can ask on meta.stackoverflow.com (the mother of all the meta sites) why they return a 404 error, instead of the expected 403. The link is correct, though.
    – apaderno Mod
    Dec 24, 2011 at 13:53
  • Thank you... I've updated the question to focus on the usability issue your information helped uncover. If you have the privileges, and you think it's a good idea, please do migrate this to the main SE Meta site. Thanks again.
    – Jim Kirkpatrick
    Dec 24, 2011 at 14:20
  • The only users who can migrate to Meta Stack Overflow are moderators. Asking the question there is up to you. Consider that asking the question on MSO gets an answer from the developers quicker, as they first monitor MSO, and then any other meta site; secondarily, if you want to propose a change, and you want to get a more large consensus, you should ask on MSO. There are few users who visit this meta, and not all the users of Stack Overflow (which would be agree in changing the behavior) read questions here.
    – apaderno Mod
    Dec 24, 2011 at 14:32
0

There must have been an update made to that page because now when clicking the "suggested edits tab in the review section" link on the "Approve or reject tag wiki edits" page, the 404 is gone and this message shows instead:

This page requires more privileges

The page you're trying to visit requires the privilege “approve tag wiki edits.”

You receive additional privileges on Drupal Answers by earning more reputation through participation on the site. When you have earned at least 5000 reputation, you will receive the “approve tag wiki edits” privilege and will be allowed to view this page.

Visit the privileges page to learn more about the privileges you can earn.

This issue has been silently fixed, so I'm answering this myself. Thanks to all who advised.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .