Basic Auth has become increasingly difficult to use as a generic way to protect a web app. Many apps these days have endpoints that respond with 401 when a user

Basic Auth has become increasingly difficult to use as a generic way to protect a web app. Many apps these days have endpoints that respond with 401 when a user isn't logged in, which if you're fronting the application with basic auth, results in the user being "logged out" as the browser thinks the credentials are no longer valid. The hijacking of HTTP status codes by client-side apps wanting to interpret them in their own way makes me think we need a new range of codes for user-defined statuses.