3 ms·

I agree. I’ve never run into a situation in my professional work as a software engineer where there has been confusion about these two terms. The only problem

I agree. I’ve never run into a situation in my professional work as a software engineer where there has been confusion about these two terms. The only problem I have is that I can never remember which one maps to HTTP status codes 401 and 403. But that’s just a personal quirk. Words mean specific things, let’s not dilute or overload the definitions of other words to avoid a confusion that may only exist in the mind of the individual writing the blog. We already have so many overloaded terms in software engineering.

cnity 2y ago
> The only problem I have is that I can never remember which one maps to HTTP status codes 401 and 403. But that’s just a personal quirk. It's probably because the name of the codes is actually wrong. 401 is called "unauthorized" but actually means "unathenticated" in every situation I've seen it used. 403 is called "forbidden" which is fine, but is synonymous with "unauthorized" in this case.
- 9Ljdg6p8ZSzejt 2y ago
  It isn't that the codes are named wrongly. 401 Unauthorized means you don't have permission to access the page, whether you're authenticated or not. 403 Forbidden means you can never access the page, regardless of permissions. This is typical in multi-tenant setups or when a site is never accessible to unauthenticated users. The distinction is subtle but important, and developers often misuse these codes, serving 403 Forbidden for authorization issues instead of indicating a permanent block.
  - cnity 2y ago
    The MDN docs state this about 401[0]: > Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. [0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#client_error_responses https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#cli...
chuckadams 2y ago
Like others said, 401 Unauthorized really means unauthenticated. Authentication comes before Authorization, both in the process and alphabetically, and 401 comes before 403. Hope that helps.
- redwoolf 2y ago
  I mean more that I always have to look it up to double check. But I like the tip to remember by thinking of the sequence and the numerical order. That does help!

cnity 2y ago

> The only problem I have is that I can never remember which one maps to HTTP status codes 401 and 403. But that’s just a personal quirk. It's probably because the name of the codes is actually wrong. 401 is called "unauthorized" but actually means "unathenticated" in every situation I've seen it used. 403 is called "forbidden" which is fine, but is synonymous with "unauthorized" in this case.

9Ljdg6p8ZSzejt 2y ago
It isn't that the codes are named wrongly. 401 Unauthorized means you don't have permission to access the page, whether you're authenticated or not. 403 Forbidden means you can never access the page, regardless of permissions. This is typical in multi-tenant setups or when a site is never accessible to unauthenticated users. The distinction is subtle but important, and developers often misuse these codes, serving 403 Forbidden for authorization issues instead of indicating a permanent block.
- cnity 2y ago
  The MDN docs state this about 401[0]: > Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. [0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#client_error_responses https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#cli...

chuckadams 2y ago

Like others said, 401 Unauthorized really means unauthenticated. Authentication comes before Authorization, both in the process and alphabetically, and 401 comes before 403. Hope that helps.

redwoolf 2y ago
I mean more that I always have to look it up to double check. But I like the tip to remember by thinking of the sequence and the numerical order. That does help!