Re:Instead of "auth", we should say "permissions" and "login"
by 9Ljdg6p8ZSzejt on Wednesday May 29, 2024 @06:02PM
(#40517557)
It isn't that the codes are named wrongly. 401 Unauthorized means you don't have permission to access the page, whether you're authenticated or not. 403 Forbidden means you can never access the page, regardless of permissions. This is typical in multi-tenant setups or when a site is never accessible to unauthenticated users. The distinction is subtle but important, and developers often misuse these codes, serving 403 Forbidden for authorization issues instead of indicating a permanent block.
Re:Instead of "auth", we should say "permissions" and "login"
by cnity on Monday June 03, 2024 @07:59AM
(#40561805)
The MDN docs state this about 401[0]:
> Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response.
[0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#cli...
It's probably because the name of the codes is actually wrong. 401 is called "unauthorized" but actually means "unathenticated" in every situation I've seen it used. 403 is called "forbidden" which is fine, but is synonymous with "unauthorized" in this case.