Set http status code to 417 when request API with wrong custom header

Question

I have an API (based on dotnet core 5 if it matters) that supports multi tenancy. all requests must have a custom header (like X) that indicates the selected tenant. So based on this scenario I have two main questions.

Is it true to accept tenant via header? (any security consideration or another suggestion would be appropriate)
Is it true to return HTTP status code 417 when clients request a tenant that does not exist or is not valid?

Community · Accepted Answer · 2021-10-07 11:07:30Z

1

Yes, it is okay to accept the tenant via header. As far as security is concerned, it depends on your security mechanism to restrict access to the API.
As par RFC 7231, the status code 417 has more to do with Expect header. If the tenant does not exist, 401 - Unauthorized would be more suitable, and a 403 - Forbidden if it's a valid tenant but doesn't have the privilege to perform the operation.

edited Oct 7, 2021 at 11:07

CommunityBot

11 silver badge

answered Apr 29, 2021 at 18:20

Debargha Roy

2,7382 gold badges20 silver badges46 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Set http status code to 417 when request API with wrong custom header

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related