{"action":"created","issue":{"url":"https://api.github.com/repos/mitodl/lore/issues/128","labels_url":"https://api.github.com/repos/mitodl/lore/issues/128/labels{/name}","comments_url":"https://api.github.com/repos/mitodl/lore/issues/128/comments","events_url":"https://api.github.com/repos/mitodl/lore/issues/128/events","html_url":"https://github.com/mitodl/lore/issues/128","id":86421018,"number":128,"title":"return 404 on unauthorized requests instead of 403","user":{"login":"pdpinch","id":430126,"avatar_url":"https://avatars.githubusercontent.com/u/430126?v=3","gravatar_id":"","url":"https://api.github.com/users/pdpinch","html_url":"https://github.com/pdpinch","followers_url":"https://api.github.com/users/pdpinch/followers","following_url":"https://api.github.com/users/pdpinch/following{/other_user}","gists_url":"https://api.github.com/users/pdpinch/gists{/gist_id}","starred_url":"https://api.github.com/users/pdpinch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pdpinch/subscriptions","organizations_url":"https://api.github.com/users/pdpinch/orgs","repos_url":"https://api.github.com/users/pdpinch/repos","events_url":"https://api.github.com/users/pdpinch/events{/privacy}","received_events_url":"https://api.github.com/users/pdpinch/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-06-09T03:00:07Z","updated_at":"2015-06-09T03:19:08Z","closed_at":null,"body":"See https://github.com/mitodl/lore/pull/117/files#r31979721\r\n\r\n> django-guardian doesn't appear to have a comparable permission_required_or_404 decorator."},"comment":{"url":"https://api.github.com/repos/mitodl/lore/issues/comments/110210291","html_url":"https://github.com/mitodl/lore/issues/128#issuecomment-110210291","issue_url":"https://api.github.com/repos/mitodl/lore/issues/128","id":110210291,"user":{"login":"ShawnMilo","id":130120,"avatar_url":"https://avatars.githubusercontent.com/u/130120?v=3","gravatar_id":"","url":"https://api.github.com/users/ShawnMilo","html_url":"https://github.com/ShawnMilo","followers_url":"https://api.github.com/users/ShawnMilo/followers","following_url":"https://api.github.com/users/ShawnMilo/following{/other_user}","gists_url":"https://api.github.com/users/ShawnMilo/gists{/gist_id}","starred_url":"https://api.github.com/users/ShawnMilo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ShawnMilo/subscriptions","organizations_url":"https://api.github.com/users/ShawnMilo/orgs","repos_url":"https://api.github.com/users/ShawnMilo/repos","events_url":"https://api.github.com/users/ShawnMilo/events{/privacy}","received_events_url":"https://api.github.com/users/ShawnMilo/received_events","type":"User","site_admin":false},"created_at":"2015-06-09T03:19:08Z","updated_at":"2015-06-09T03:19:08Z","body":"One possibility: Create [middleware](https://docs.djangoproject.com/en/1.8/topics/http/middleware/) that uses [process_response](https://docs.djangoproject.com/en/1.8/topics/http/middleware/#process-response) to check the status code, and if it's 4xx, return 404.\r\n\r\nSince 4xx errors are \"user did something wrong\" errors, and the goal is to prevent information leakage, then this seems viable, especially because it won't mask 5xx (our code messed up) errors."}}