4 ms·
> The only problem I have is that I can never remember which one maps to HTTP status codes 401 and 403. But that’s just a personal quirk. It's probably because
by cnity 2y ago
> The only problem I have is that I can never remember which one maps to HTTP status codes 401 and 403. But that’s just a personal quirk.
It's probably because the name of the codes is actually wrong. 401 is called "unauthorized" but actually means "unathenticated" in every situation I've seen it used. 403 is called "forbidden" which is fine, but is synonymous with "unauthorized" in this case.
- 9Ljdg6p8ZSzejt 2y agoIt isn't that the codes are named wrongly. 401 Unauthorized means you don't have permission to access the page, whether you're authenticated or not. 403 Forbidden means you can never access the page, regardless of permissions. This is typical in multi-tenant setups or when a site is never accessible to unauthenticated users. The distinction is subtle but important, and developers often misuse these codes, serving 403 Forbidden for authorization issues instead of indicating a permanent block.
- cnity 2y agoThe MDN docs state this about 401[0]: > Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response. [0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#client_error_responses https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#cli...