Maybe in 4.0 if you're OK ?

@LouisGac and @c_schmitz : another reason to have a clear 400 or 401 or etc … : logging attack is something very important. And some tools get it to autoban IP

fail2ban for example : https://stackoverflow.com/questions/24250946/fail2ban-to-block-403-errors-apache

But better : https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/apache-noscript.conf (for 401 here)

We might want to document desired behaviour on the code guideline?

@ollehar : i have 2 times where we need to have log about attack on server.

With redirect : no way to log

Why 0% user affected ?

We might want to document desired behaviour on the code guideline?

Ah yes, OK.

We clearly need more log possibility.

2 times out of millions and millions of requests....? Not sure it's an application responsibility either. :d