When an authenticated request fails, how do you choose between returning 401 and 403? Give a concrete example of each and what a well-behaved client does differently in response.

Question

Answer

Stay specific. One example, told well, beats three told fast. Make your decisions visible — what you chose between. End on what changed, for whom.

When an authenticated request fails, how do you choose between returning 401 and 403? Give a concrete example of each and what a well-behaved client does differently in response.

Practice more