On the client side, whether a GET returned a successful (2xx) or error (4xx&#x2F;5xx) status is observable for cross-origin requests. This can leak information about the user, particularly if you have cookie-authenticated resources that 503 depending on the user&#x27;s identity (e.g. Facebook 503ing if you&#x27;re not friends with X). This can be resolved by requiring a CSRF token or fancy header, but that muddles the RESTful semantics.<p>A common solution is to make your public API RESTful and authenticated differently from your browser cookie sessions, and make the private web APIs always return 200.