That's an intended behavior. User that doesn't have access to a resource should not know whether it exists or not
That's an intended behavior. User that doesn't have access to a resource should not know whether it exists or not