Summary
Fluxer does not send channels which the user does not have permission to view to the user (unlike Discord). However, a user can find out whether a channel has been deleted or just made hidden if they know the channel ID, by using the API. This is not a big deal but since Fluxer is already fully hiding channels the behavior should be changed here so that it is truly not possible to know this information either. The API will return 403 instead of 404 when requesting channel info for a channel which you do not have access to view. An example is a channel in Fluxer HQ which has been archived:GET https://api.fluxer.app/v1/channels/1494000808691269576.
Steps to reproduce
- Know the ID of a channel which you don't have permission to view. This can be achieved by using an alt account.
- Send
GET https://api.fluxer.app/v1/channels/:channel_idwith authorization. - The API will respond
403 ForbiddenwithMISSING_PERMISSIONS. It should return404as if the channel didn't exist in my opinion.
Environment (optional)
canary build 485 (e1d3a7b), 2026-04-27 18:03:32 UTC, Electron 41.2.2, Linux 6.19.13-arch1-1 (x64), desktop canary 0.0.50
3 comments
Comment by Rex
Comment by @JuxGD
MISSING_PERMISSIONSwas implemented into the API, doesn't that make this intended functionality (aka not a bug)?Comment by @PilkeySEK