Nested routers do not return 404 error for non-existing resources

Let we have the following models

class Book(models.Model): 
       id = models.CharField()

class Page(models.Model):
      book = models.ForeignKey('Book')

and there is no books and no pages in the db. The URL to list pages related to certain book is /books/<BookID>/pages/.

How to reproduce: perform GET request to /books/999/pages/

Expected result 404 code is returned because there is no book with id 999

Actual result Empty list is returned.

[sgalaburda]

Yeah, I agree that this is not trivial to implement and will require extra DB query. We can make it optional for people to decide if they need more strict behavior for the price of extra query.

Talking about prefiltered querysets, we can do nothing to protect from such cases but people always can shoot themselves in the leg. What we can do is to cover this well in docs.

[cancan101]

From a security standpoint I would like to make sure that as user that is not permissioned to “view” book 999 gets the SAME HTTP code when accessing /books/999/pages/ if it exists or it does not exists.

In other words I do not want a malicious user to be able to map out the existence of books that he should not know about using the nested structure.