ASP.NET Core Interview Question #143

What is the difference between 401 Unauthorized and 403 Forbidden?

Authentication, Authorization & Security Mid-Level Intermediate

Quick Interview Answer

Despite its historical name, HTTP 401 generally means the request is not successfully authenticated for the protected resource. The server can issue an authentication challenge telling the client how to authenticate.

Detailed Explanation

HTTP 403 means the server understood the request and the identity may be authenticated, but access is not permitted under the authorization rules. In ASP.NET Core these outcomes commonly correspond to Challenge and Forbid respectively.

Code Example

if (User.Identity?.IsAuthenticated != true)
    return Challenge();

if (!User.IsInRole("Admin"))
    return Forbid();