• 4 Posts
  • 102 Comments
Joined 1 year ago
cake
Cake day: July 16th, 2023

help-circle



















  • to be even more pedantic, if we follow the relevant official RFCs for http (formerly 2616, but now 7230-7235 which have relevant changes), a 403 can substitute for a 401, but a 401 has specific requirements:

    The server generating a 401 response MUST send a WWW-Authenticate header field (Section 4.1) containing at least one challenge applicable to the target resource.

    (the old 2616 said 403 must not respond with a request for authentication but the new versions don’t seem to mention that)