2 Matching Annotations
  1. Jan 2022
  2. flaviabastos.ca flaviabastos.ca
    The difference between HTTP status codes 401 and 403: Unauthorized and Forbidden
    2
    1. TylerRick 20 Jan 2022
      Next, let’s say that your ticket is correct (so you made through security just fine!) and the gate number in your ticket says “Gate 24” but you walk to Gate 27. The attendant cannot authorize you to go through that gate because it’s not the right gate for your ticket.

      They have these mixed up! (Which is understandable, because 401 is misnamed "Unauthorized but should be named "Unauthenticated")

      Checking if authenticated (which, if it fails the check, should return 401 for authentication error) comes first,

      and then checking if authorized (which, if it fails the check, should return 403 for authorization error)

      See https://hyp.is/wRF7wHopEeynafOqKj81vw/stackoverflow.com/questions/3297048/403-forbidden-vs-401-unauthorized-http-responses

      poor analogy they were confused easy to confuse (mix up) misnomer
    2. TylerRick 20 Jan 2022
      If the ticket is incorrect or damaged, you cannot even go through the airport security: when they check your ticket, it will be refused. You are Forbidden to enter the boarding area of the airport.

      It depends what we mean by "incorrect"/damaged "credentials ("ticket")...

      A. If they are invalid or incorrect in the sense that we can't authenticate them as anyone (as it sounds like you mean with "incorrect" or "damaged") (they're not a user in our database or the password doesn't match a user in our database), then you should actually use 401, meaning that the client can/should try (again) to authenticate with different credentials.

      B. But if by "incorrect" you mean (as it sounds like you mean with "you cannot even go through the airport security: when they check your ticket, it will be refused") that the credentials were valid enough to authenticate you as someone (a user in our database), but that (known( user has insufficient credentials, then correct, it should be a 403 forbidden.

      It's even easier to explain / think about if you just think of 401 as being used for any missing or failed authentication. See:

      HTTP 401 I disagree poor analogy they were confused they were mistaken
    Visit annotations in context

    Tags

    Annotators

    URL

    flaviabastos.ca/2021/11/17/the-difference-between-http-status-codes-401-and-403-unauthorized-and-forbidden/