15

Alternative and much more boring title: Should a 404 result reveal the post title?

I ran across some odd behaviour today. When manually entering a Stack Exchange URL into the address bar1, if you pick a post number that has been deleted then you still see the old post title along with the 404.

For example, I entered:

  • http://webapps.stackexchange.com/questions/34 and the resolved address came back as http://webapps.stackexchange.com/questions/34/what-is-the-best-empire-avenue-stock-to-buy

  • And http://stackoverflow.com/questions/3 came back as http://stackoverflow.com/questions/1/where-oh-where-did-the-joel-data-go/3#32

Note, I'm obviously not a 10k+ user on either of those sites, which is why they 404'd

It's not that big of a deal, but it seems like this leaks information about the site(s) that we may not want exposed.

And since a picture is worth N words:

404 screenshot Stuff I probably shouldn't be able to see is highlighted.

1And why was I manually entering posts like that? Because I was trying to find a benign 404 example from Web Applications that I could share with others because I think their 404 image is hilarious.
2And where did this fabled Joel data go? Inquiring minds want to know!

  • 1
    if deleted as spam I'd say no. – ratchet freak Feb 20 '15 at 15:01
  • 5
    What's bad about showing what the title was? – random Feb 20 '15 at 15:03
  • 2
    @random programmers.stackexchange.com/questions/222067 (this is a spam title example; there was another example, where slug revealed personal offense but it was edited out by SE community manager) – gnat Feb 20 '15 at 15:11
  • 2
    @random - those examples happened to be benign. But it's possible that spam or other defacement could be present. Likewise, I don't know if SE already knows of this and doesn't care, or if this is new information for them. The clickbait title was to help bump the visibility to it gets noticed. – user194162 Feb 20 '15 at 15:11
  • 1
    If you just want to show someone the 404 page, webapps.stackexchange.com/404 would do. (It's still up to debate whether this is a link to the 404 page, or a nonexistent page that shows 404. :) – user259867 Feb 20 '15 at 15:55
13

We send a HTTP 404 with those pages, what is shown (title, or the whole thing if you have the rep) is just a convenience for the owner of the post or users that have the privilege to see it.

Crawlers see 404 and .. stop caring, and that's really the only case we need to worry about when we consider the ramifications of 'leaking' deleted spammy titles. That hasn't been an issue so far, on any site.

I suppose we could put more moving parts in how we redirect all the things to avoid that, but since it's not at all actively harmful, I don't think it really justifies (what could turn out to be) a somewhat lengthy and frustrating effort.

  • Sounds like "working as designed" then. Thanks for the answer. – user194162 Feb 20 '15 at 15:13
  • 2
    For me, offensive titles (possibly leaking personal information about an SE user) is more of a concern than spam. Sometimes these are bad enough to get edited out: here, here, and here. – user259867 Feb 20 '15 at 16:27
  • @FamousBlueRaincoat When that happens we get involved, and we have the ability to completely obliterate revisions. <title>These aren't the droid's you're looking for, you creepy sonofabuffoon</title> :) – Tim Post Feb 20 '15 at 16:43
  • 3
    This is still information leak. People without the required reputation should not be able to see deleted posts, or their title. Sure it's not a big deal, but it's still wrong, in my opinion. – Shadow The Princess Wizard Dec 1 at 8:14
  • 3
    Performing a redirect to add content to the URI when the resource was not found makes no sense! – Lightness Races with Monica Dec 1 at 20:01
  • From what I can tell, this was changed at some point after this answer (I'm guessing around the time we made the unified 404 template). If I hit a deleted question while logged in as someone with the rep to do it, I get a 200 status code, and the deleted question. Without the privilege, I get a 404, without the title of the requested document. – Tim Post Dec 2 at 15:08
  • @TimPost I can confirm that 404 errors include the post title still, at least for me. – Jon Harper Dec 2 at 20:07
  • That's strange, they don't when I go incognito. I'm going to go poking around a bit because it's pretty clear something is unintentional here, I'm just not sure which thing. – Tim Post Dec 3 at 3:51

You must log in to answer this question.