401 Unauthorized vs 403 Forbidden in Rest API - Practice Questions

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding 401 Unauthorized

Which statement best describes the HTTP 401 Unauthorized status code?

A The server understood the request but refuses to authorize it.

B The server encountered an unexpected condition.

C The requested resource is not found on the server.

D The client must authenticate itself to get the requested response.

💡 Hint

Think about when the server asks for credentials.

401 Unauthorized means the client needs to provide valid authentication credentials to access the resource.

🧠 Conceptual

intermediate

Understanding 403 Forbidden

Which statement best describes the HTTP 403 Forbidden status code?

A The server cannot find the requested resource.

B The client must authenticate itself to get the requested response.

C The server refuses to authorize the request even if the client is authenticated.

D The request was malformed or invalid.

💡 Hint

Think about when authentication is done but access is denied.

403 Forbidden means the server understood the request and the client is authenticated, but the client does not have permission to access the resource.

❓ Predict Output

advanced

Identify the HTTP status code returned

What HTTP status code will this API return if the client sends no authentication token?

Rest API

def api_request(auth_token=None):
    if auth_token is None:
        return 401
    elif auth_token == 'valid_token':
        return 200
    else:
        return 403

print(api_request())

A 401

B 200

C 403

D 500

💡 Hint

Check what happens when auth_token is None.

If no token is provided, the function returns 401 Unauthorized.

❓ Predict Output

advanced

Determine the HTTP status code for invalid token

What HTTP status code will this API return if the client sends an invalid authentication token?

Rest API

def api_request(auth_token=None):
    if auth_token is None:
        return 401
    elif auth_token == 'valid_token':
        return 200
    else:
        return 403

print(api_request('invalid_token'))

A 403

B 404

C 401

D 200

💡 Hint

Check what happens when auth_token is not None and not valid.

If the token is invalid, the function returns 403 Forbidden.

🚀 Application

expert

Choose the correct HTTP status code for a scenario

A user tries to access a private page on a website. They are logged in but do not have permission to view this page. Which HTTP status code should the server return?

A 404 Not Found

B 403 Forbidden

C 401 Unauthorized

D 500 Internal Server Error

💡 Hint

The user is authenticated but not allowed to access the resource.

403 Forbidden is used when the user is authenticated but lacks permission to access the resource.

Practice

1. What does the HTTP status code 401 Unauthorized indicate in a REST API?

easy

A. The client is not authenticated or provided invalid credentials.

B. The client is authenticated but does not have permission to access the resource.

C. The requested resource was not found on the server.

D. The server encountered an internal error while processing the request.

Solution

1. Step 1: Understand the meaning of 401 Unauthorized

   The 401 status code means the client must authenticate itself to get the requested response. It usually means no or bad login info.

2. Step 2: Differentiate from 403 Forbidden

   403 means the client is authenticated but lacks permission. 401 means no valid authentication.

3. Final Answer:

   The client is not authenticated or provided invalid credentials. -> Option A

4. Quick Check:

   401 Unauthorized = No or bad login info [OK]

Hint: 401 means login problem; 403 means no permission [OK]

Common Mistakes:

• Confusing 401 with 403
• Thinking 401 means resource missing
• Assuming 401 means server error

2. Which HTTP status code should a REST API return when a user is logged in but tries to access a resource they don't have rights for?

easy

A. 404 Not Found

B. 401 Unauthorized

C. 403 Forbidden

D. 500 Internal Server Error

Solution

1. Step 1: Identify the meaning of 403 Forbidden

   403 means the user is authenticated but does not have permission to access the resource.

2. Step 2: Confirm 401 is for unauthenticated users

   401 is for users who are not logged in or have invalid credentials, so it does not apply here.

3. Final Answer:

   403 Forbidden -> Option C

4. Quick Check:

   403 Forbidden = Logged in but no permission [OK]

Hint: 403 means permission denied after login [OK]

Common Mistakes:

• Using 401 when user is logged in
• Confusing 403 with 404 Not Found
• Thinking 403 means server error

3. Consider this REST API response scenario:

{"status":401,"message":"Invalid token"}

What does this response tell the client?

medium

A. The client provided an invalid or missing authentication token.

B. The server failed to process the request due to an error.

C. The requested resource does not exist.

D. The client is authenticated but forbidden to access the resource.

Solution

1. Step 1: Analyze the status code 401

   401 means unauthorized, so the client is not properly authenticated.

2. Step 2: Interpret the message "Invalid token"

   This indicates the authentication token is missing or invalid, so the client must provide valid credentials.

3. Final Answer:

   The client provided an invalid or missing authentication token. -> Option A

4. Quick Check:

   401 + "Invalid token" = Bad login info [OK]

Hint: 401 with token error means bad or missing login [OK]

Common Mistakes:

• Thinking 401 means permission denied
• Assuming resource is missing
• Confusing 401 with server error

4. You have this REST API code snippet:

if (!user.isLoggedIn()) {
  return 403;
} else if (!user.hasAccess()) {
  return 401;
}

What is wrong with this code?

medium

A. It returns 401 when user lacks access, should be 403 instead.

B. The code is correct as is.

C. It should return 404 for unauthorized access.

D. It returns 403 when user is not logged in, should be 401 instead.

Solution

1. Step 1: Check the meaning of 401 and 403

   401 means unauthorized (not logged in), 403 means forbidden (no permission).

2. Step 2: Analyze the code logic

   The code returns 403 when user is not logged in, which is incorrect. It should return 401 here. It returns 401 when user lacks access, which should be 403.

3. Final Answer:

   It returns 403 when user is not logged in, should be 401 instead. -> Option D

4. Quick Check:

   Not logged in = 401, no permission = 403 [OK]

Hint: 401 for no login, 403 for no permission [OK]

Common Mistakes:

• Swapping 401 and 403 codes
• Using 404 for unauthorized
• Assuming code is correct without checking status meanings

5. You are designing a REST API for a file storage service. A user tries to access a file:

GET /files/123

The user is logged in but does not own the file. Which status code should your API return and why?

hard

A. 401 Unauthorized, because the user must re-authenticate to access the file.

B. 403 Forbidden, because the user is authenticated but not allowed to access this file.

C. 404 Not Found, to hide the existence of the file from unauthorized users.

D. 500 Internal Server Error, because the server cannot process the request.

Solution

1. Step 1: Determine user's authentication and ownership

   The user is logged in (authenticated) but does not own the file, so lacks permission.

2. Step 2: Choose correct status code for permission denial

   403 Forbidden is the correct code when the user is authenticated but not allowed to access the resource.

3. Final Answer:

   403 Forbidden, because the user is authenticated but not allowed to access this file. -> Option B

4. Quick Check:

   Logged in + no permission = 403 Forbidden [OK]

Hint: Logged in but no access? Return 403 Forbidden [OK]

Common Mistakes:

• Using 401 when user is logged in
• Using 404 to hide resource instead of 403
• Confusing 500 error with permission issues