# Clicking Reaction counter will encounter 403 loop if a post is hidden

**URL:** https://meta.discourse.org/t/clicking-reaction-counter-will-encounter-403-loop-if-a-post-is-hidden/404053
**Category:** Bug
**Tags:** reactions
**Created:** [29 במאי,‏ 2026,‏ 2:53am UTC](https://meta.discourse.org/t/clicking-reaction-counter-will-encounter-403-loop-if-a-post-is-hidden/404053 "2026-05-29T02:53:01Z")
**Posts on this page:** 1
**Showing post:** 1

<div class="post-metadata">

### Author: ![small-lovely-cat](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/small-lovely-cat/32/553546_2.png) [@small-lovely-cat](https://meta.discourse.org/u/small-lovely-cat)
#### Post date: [29 במאי,‏ 2026,‏ 2:53am UTC](https://meta.discourse.org/t/clicking-reaction-counter-will-encounter-403-loop-if-a-post-is-hidden/404053/1 "2026-05-29T02:53:01Z")

</div>

The backend `/discourse-reactions/app/controllers/discourse_reactions/custom_reactions_controller.rb` uses `guardian.ensure_can_see!(post)` to restrict users without permission from loading the reactions when a post is hidden.

However, the frontend still renders the reaction couter, thus, when users click the reaction couter of a hidden post, there will be infinite loading, with 403 forbidden while getting `/discourse-reactions/posts/xxx/reactions-users-list.json`

This commit add a similar guard at the frontend, hide reaction couter while `args.post.hidden && !args.post.can_see_hidden_post`, so as to fix this problem.

 ![595836870-87c39f7f-5b8b-4555-a877-fe74714e16ca](https://global.discourse-cdn.com/meta/original/4X/9/9/7/997294ab7bbc618801c5d3121bca466f5d682a85.png)  
PR: [FIX: reactions shouldn't be visible to users without see\_hidden\_post permission if a post is hidden by small-lovely-cat · Pull Request #40216 · discourse/discourse · GitHub](https://github.com/discourse/discourse/pull/40216)

---

_[View the full topic](https://meta.discourse.org/t/clicking-reaction-counter-will-encounter-403-loop-if-a-post-is-hidden/404053)._