Databases
StackOverflow2013
Postsdbo
POCorrect http status code for resource which requires authorization
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POCorrect http status code for resource which requires authorization
    primarykey
    data
    text
    <p>There seems to be a lot of confusion about the correct http status code to return if the user tries to access a page which requires the user to login.</p> <p>So basically what status code will be send when I show the login page?</p> <p>I'm pretty sure we need to use a status code in the <code>4xx</code> range.</p> <p>I'm not talking about HTTP authentication here, so that's at least 1 status code we aren't going to use (<code>401 Unauthorized</code>).</p> <p>Now what should we use? The answers (also here on SO) seem to vary:</p> <p>According to the answer <a href="https://stackoverflow.com/questions/4301877/http-status-code-for-missing-authentication#answer-4301901">here</a> we should use <code>403 Forbidden</code>.</p> <p>But in the description of the status code is:</p> <blockquote> <p>Authorization will not help and the request SHOULD NOT be repeated.</p> </blockquote> <p>Well that doesn't look like the right one. Since authorization WOULD help.</p> <p>So let´s check out some other answer. The answer <a href="https://stackoverflow.com/questions/2839585/what-is-correct-http-status-code-when-redirecting-to-a-login-page#answer-2839594">here</a> even doesn't use the <code>4xx</code> range at all but rather uses <code>302 Found</code></p> <p>The description of the <code>302 Found</code> status code:</p> <blockquote> <p>The requested resource resides temporarily under a different URI. Since the redirection might be altered on occasion, the client SHOULD continue to use the Request-URI for future requests. This response is only cacheable if indicated by a Cache-Control or Expires header field.</p> </blockquote> <p>I think that also isn't what I want. Since it is not the requested resource which resides under a different URI. But rather a completely different resource (login page vs authenticated content page).</p> <p>So I moved along and picked another <a href="https://stackoverflow.com/questions/6110672/correct-http-status-code-for-login-form#answer-6110891">answer</a> surprisingly with yet another solution.</p> <p>This answer suggest we choose <code>400 Bad Request</code>.</p> <p>The description of this status code is:</p> <blockquote> <p>The request could not be understood by the server due to malformed syntax. The client SHOULD NOT repeat the request without modifications.</p> </blockquote> <p>I think the server understood the request just fine, but just refuses to give access before the user is authenticated.</p> <p>Another <a href="https://stackoverflow.com/questions/4301877/http-status-code-for-missing-authentication#answer-4301905">answer</a> also says a <code>403</code> response is correct, however it ends with:</p> <blockquote> <p>If this is a public facing website where you are trying to deny access based on a session cookie [that's what I do], 200 with an appropriate body to indicate that log in is needed or a 302 temporary redirect to a log in page is often best.</p> </blockquote> <p>So <code>403</code> is correct, but <code>200</code> or <code>302</code> is THE BEST.</p> <p>Hey! That's what I am looking for: THE BEST solution. But shouldn't the best be the same as the correct one? And why would it be the best?</p> <p>Thanks to all who have made it this far into this question :)</p> <p>I know I shouldn't worry too much about it. And I think this question is more hypothetical (not really, but used it because of lack of a better word).</p> <p>But this question is haunting me for some time now.</p> <p>And if I would have been a manager (who just picked up some cool sounding words as they always do) I would have said: but, but, but, but restfulness is important. :-)</p> <p>So: what is <code>the right way™</code> of using a status code in the above situation (if any)?</p> <p><strong>tl;dr</strong></p> <p>What is the correct http status code response when a user tries to access a page which requires login?</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. USCommunity
    1. USPeeHaa
    plurals
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    3. PL
      singulars
      1. LTLinked
    1. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POCorrect http status code for resource which requires authorization
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POCorrect http status code for resource which requires authorization
      1. USPeeHaa
      1. VTBountyStart
    3. VO
      singulars
      1. POCorrect http status code for resource which requires authorization
      1. This table or related slice is empty.
      1. VTUpMod
    1. COits up to you if not 401 then 200 or 302, i use 200, Ide say check the headers for the largest, search provider and socal network site, and see what headers there returning.
      singulars
      1. POCorrect http status code for resource which requires authorization
      1. USdavid
    2. CO`412 Precondition Failed`... The Precondition being authenticated with the service via a means other than WWW-Auth. There is no best response here. I personally use `403 Forbidden` since that's what is going on. The "Authorization will not help and the request SHOULD NOT be repeated." is referring to "WWW-Auth".
      singulars
      1. POCorrect http status code for resource which requires authorization
      1. USAndrew Moore
    3. COThe correct answer is [418: I'm a teapot](http://meta.stackexchange.com/a/185449/166899).
      singulars
      1. POCorrect http status code for resource which requires authorization
      1. USMadara Uchiha
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload