Why does detailed 404 security setting not explain why I can't access subcategory?

Product Support

AI-generated summary

Nikki_Locke reports that users receiving links to group-restricted subcategories see a confusing 404 page with no explanation, even after enabling the “detailed 404” setting — which instead hides the original URL and displays only the forum description in the page source. codinghorror requests example URLs for clarity, but Nikki_Locke notes the site is private and offers to invite them. justin confirms this is normal behavior: Discourse intentionally hides restricted content to avoid leaking information, and there’s no built-in setting to show users which group they need to join. A custom plugin would be required, but it’s non-trivial and costly. Stephen adds that revealing restricted content would compromise privacy. Nikki_Locke asks what the “detailed 404” setting is actually for, if not to help users understand access restrictions.

1

We have used Discourse groups extensively so that people have to join a group to see most subcategories.

People are now complaining that, if someone sends them a link to something which is in a group they are not a member of, they get a mystifying 404 page that tells them nothing.

I would like the page to tell them which group the subcategory is in (with a link to the group, if it is public or invite only).

I stumbled on the “detailed 404” setting under Security, and turned it on. Now things are even worse! The page you get to looks the same, but the url at the top is no longer the url the user pasted in, but /404. There is no information visible on the page to tell you why it is private.

The page source is quite different, however, and there is a header:

    <meta name="description" content="This forum is owned by Wigan Local Group. It is a public discussion forum for the work of the group. Enquire here to contact us or join any of our private forums.">

(This is the forum description post).

Is there some other setting somewhere that I need to change to make this work as designed?

2

Can you provide specific URLs as examples? I am having trouble understanding what you’ve written here.

3

Difficult, as out server is not open to the public. If you would like to PM me your email address, I can invite you to it.

4

Can you provide representative URLs with the relevant bits (domain, etc) changed to other nonsense words?

5

I think what you’re describing is normal behavior for the site.

Instead of the 404 page showing on categories that a user does not have access to, you want a page that shows them what the category is and to be able to join the group to access it?

There’s no way to configure this in Discourse, but you could get someone to write a plugin for this in Marketplace. This isn’t a trivial effort, though, so you will need to have a reasonable budget for this.

6

The alternative is to acknowledge that a post or category exists, potentially leaking information.

7

Thanks. If that is the case, what is the detailed 404 setting for, then?