Status codes · 1xx–5xx
401, 403, 404 and 407: identity or permission?
Connect authentication and authorization to real HTTP decisions.
Understand the concept
Despite its name, 401 typically means usable authentication credentials have not been established. Missing, invalid or expired credentials can trigger it. An origin server generating 401 must include an applicable WWW-Authenticate challenge. A Bearer handler may use scheme-specific error parameters, without disclosing tokens or internal validation details.
403 means the server understood the request but refuses to fulfil it. A valid identity lacking a role, policy, scope or resource permission commonly receives it. Logging in again does not automatically fix that permission. A server may use 404 to conceal a protected resource’s existence; apply such a policy consistently. Not every 403 proves that someone is logged in.
407 belongs to proxy authentication and uses Proxy-Authenticate. Distinguish the corporate proxy from the origin API. Handle session renewal deliberately, avoid infinite retry loops, and enforce permissions on the server rather than only hiding UI controls.
When distinguishing expired sessions from insufficient permissions in the frontend.
Refreshing on every 403 or displaying every 401 as a missing role.
FROM TERMS TO DECISIONS
What would you do with this request?
Choose an answer and read the reasoning. Revisit lessons for missed topics. Results only count correct answers to these questions; they are not a proficiency or security certification.
An API receives an expired Bearer token. Which response fits?
Answers remain in this page session; reading progress is stored separately in the browser.
One topic. Three levels of depth.
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api"Credentials are absent or invalid; the applicable scheme is advertised.
This page does not send requests to external servers. Messages are readable HTTP/1.1 illustrations, not HTTP/2 or HTTP/3 wire dumps. example.test is reserved for examples. Run commands and JavaScript only in your own test environment; never publish real tokens or cookies.
Try it yourself first.
A valid token is used to delete another customer’s report. Will a new token solve it?
Show the solution and explanation
Deny: 403 (or consistent concealment policy: 404)No. Ownership or tenant checks must deny access. This is not the same as invalid authentication.