ASP.NET Core Web API Interview Question #19

What is the difference between 401 Unauthorized and 403 Forbidden?

Web API & REST Fundamentals, Controllers, HTTP Methods & Status Codes Junior Beginner

Quick Interview Answer

401 Unauthorized means the request lacks valid authentication credentials for the protected resource. Despite its historical name, it is primarily an authentication response.

Detailed Explanation

401 Unauthorized means the request lacks valid authentication credentials for the protected resource. Despite its historical name, it is primarily an authentication response.

403 Forbidden means the server understands the authenticated identity but the user is not permitted to perform the requested operation. Authentication and authorization middleware normally produce these responses according to the configured scheme.

Code Example

[Authorize]
[HttpGet("profile")]
public IActionResult Profile() => Ok();

[Authorize(Roles = "Admin")]
[HttpDelete("{id:int}")]
public IActionResult Delete(int id) => NoContent();