3 ms·

They're so unclear that HTTP error codes got them confused. 401 Unauthorized usually actually means Unauthenticated, while 403 Forbidden means Unauthorized. I'

They're so unclear that HTTP error codes got them confused. 401 Unauthorized usually actually means Unauthenticated, while 403 Forbidden means Unauthorized. I'm a native speaker and I need to pause for a few hundred milliseconds just to be sure I'm using the right one in a sentence.

Jensson 2y ago
> Unauthorized usually actually means Unauthenticated What does "unauthenticated" even mean here? You aren't logged in, not logged in isn't a state of "unauthenticated", you haven't given any credentials meaning currently you don't have any authority, so unauthorized makes sense. You can have several sets of credentials and switch between them, not giving them any isn't being in an unauthenticated state its a different thing, and using "unauthorized" in that case makes sense.
- Control8894 2y ago
  > What does "unauthenticated" even mean here? That you're not logged in. > You aren't logged in, not logged in isn't a state of "unauthenticated" What? Yes it is. > you haven't given any credentials meaning currently you don't have any authority, so unauthorized makes sense Ok? Yes, if you are unauthenticated (and authentication is required), then you are also unauthorized. However, the error code is not communicating that you are unauthorized; it is communicating that you need to authenticate, thus unauthenticated is more appropriate. > You can have several sets of credentials and switch between them Ok? > not giving them any isn't being in an unauthenticated state its a different thing That is exactly what being in an unauthenticated state means. What would you define to be an unauthenticated state otherwise?
RiverCrochet 2y ago
While we're at it, let's change 404 from "file not found" to "nothing here." The stream thrown back at you in response to an HTTP request is often not really a file.
- dbsmith83 2y ago
  Unix would like a word (file) with you :)
withinboredom 2y ago
401 may or may not be unauthenticated, but it doesn't necessarily mean that. It just means that you do not have the authority to do whatever you were trying to do. A 401 implies that you need to gain authority to do what you want to do and try again[1]. A 403 means that it is simply forbidden. You cannot gain the authority to do what you want to do[2] and has nothing to do with credentials, no matter how nicely you ask. For example, getting a project in your organization may return 401 (simply ask an admin for access), while getting a project in a different organization may return a 403 (you cannot get access to other organizations, ever). 1: https://www.rfc-editor.org/rfc/rfc9110#name-401-unauthorized https://www.rfc-editor.org/rfc/rfc9110#name-401-unauthorized 2: https://www.rfc-editor.org/rfc/rfc9110#name-403-forbidden https://www.rfc-editor.org/rfc/rfc9110#name-403-forbidden

Jensson 2y ago

> Unauthorized usually actually means Unauthenticated What does "unauthenticated" even mean here? You aren't logged in, not logged in isn't a state of "unauthenticated", you haven't given any credentials meaning currently you don't have any authority, so unauthorized makes sense. You can have several sets of credentials and switch between them, not giving them any isn't being in an unauthenticated state its a different thing, and using "unauthorized" in that case makes sense.

Control8894 2y ago
> What does "unauthenticated" even mean here? That you're not logged in. > You aren't logged in, not logged in isn't a state of "unauthenticated" What? Yes it is. > you haven't given any credentials meaning currently you don't have any authority, so unauthorized makes sense Ok? Yes, if you are unauthenticated (and authentication is required), then you are also unauthorized. However, the error code is not communicating that you are unauthorized; it is communicating that you need to authenticate, thus unauthenticated is more appropriate. > You can have several sets of credentials and switch between them Ok? > not giving them any isn't being in an unauthenticated state its a different thing That is exactly what being in an unauthenticated state means. What would you define to be an unauthenticated state otherwise?

RiverCrochet 2y ago

While we're at it, let's change 404 from "file not found" to "nothing here." The stream thrown back at you in response to an HTTP request is often not really a file.

dbsmith83 2y ago
Unix would like a word (file) with you :)

withinboredom 2y ago

401 may or may not be unauthenticated, but it doesn't necessarily mean that. It just means that you do not have the authority to do whatever you were trying to do. A 401 implies that you need to gain authority to do what you want to do and try again[1]. A 403 means that it is simply forbidden. You cannot gain the authority to do what you want to do[2] and has nothing to do with credentials, no matter how nicely you ask. For example, getting a project in your organization may return 401 (simply ask an admin for access), while getting a project in a different organization may return a 403 (you cannot get access to other organizations, ever). 1: https://www.rfc-editor.org/rfc/rfc9110#name-401-unauthorized https://www.rfc-editor.org/rfc/rfc9110#name-401-unauthorized 2: https://www.rfc-editor.org/rfc/rfc9110#name-403-forbidden https://www.rfc-editor.org/rfc/rfc9110#name-403-forbidden