Problem/Motivation

We are starting to get requests for assets that have been removed from our Drupal site and are no longer in the {file_managed} table. However, because the image is not in {file_managed}, RSW will throw a AccessDeniedHttpException().

  • Since the image file is not found, that suggests a 404 response is more appropriate than a 403.
  • 403 implies that there is a way to access it if you are authenticated somehow. However, this case always returns a 403.
  • 403 is not typically cached at the edge. This can cause extra load on the origin if abused.

Steps to reproduce

Proposed resolution

Update RemoteImageStyleDownloadController::deliver() to use a NotFoundHttpException() instead of AccessDeniedHttpException()

Remaining tasks

User interface changes

N/A

API changes

N/A

Data model changes

N/A

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

jrearick created an issue. See original summary.

jrearick’s picture

Status: Active » Needs review
jrearick’s picture

Version: 2.1.0 » 2.x-dev