401 Unauthorized vs 403 Forbidden in Rest API - Practice Questions

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding 401 Unauthorized

Which statement best describes the HTTP 401 Unauthorized status code?

A The server understood the request but refuses to authorize it.

B The server encountered an unexpected condition.

C The requested resource is not found on the server.

D The client must authenticate itself to get the requested response.

💡 Hint

Think about when the server asks for credentials.

401 Unauthorized means the client needs to provide valid authentication credentials to access the resource.

🧠 Conceptual

intermediate

Understanding 403 Forbidden

Which statement best describes the HTTP 403 Forbidden status code?

A The server cannot find the requested resource.

B The client must authenticate itself to get the requested response.

C The server refuses to authorize the request even if the client is authenticated.

D The request was malformed or invalid.

💡 Hint

Think about when authentication is done but access is denied.

403 Forbidden means the server understood the request and the client is authenticated, but the client does not have permission to access the resource.

❓ Predict Output

advanced

Identify the HTTP status code returned

What HTTP status code will this API return if the client sends no authentication token?

Rest API

def api_request(auth_token=None):
    if auth_token is None:
        return 401
    elif auth_token == 'valid_token':
        return 200
    else:
        return 403

print(api_request())

A 401

B 200

C 403

D 500

💡 Hint

Check what happens when auth_token is None.

If no token is provided, the function returns 401 Unauthorized.

❓ Predict Output

advanced

Determine the HTTP status code for invalid token

What HTTP status code will this API return if the client sends an invalid authentication token?

Rest API

def api_request(auth_token=None):
    if auth_token is None:
        return 401
    elif auth_token == 'valid_token':
        return 200
    else:
        return 403

print(api_request('invalid_token'))

A 403

B 404

C 401

D 200

💡 Hint

Check what happens when auth_token is not None and not valid.

If the token is invalid, the function returns 403 Forbidden.

🚀 Application

expert

Choose the correct HTTP status code for a scenario

A user tries to access a private page on a website. They are logged in but do not have permission to view this page. Which HTTP status code should the server return?

A 404 Not Found

B 403 Forbidden

C 401 Unauthorized

D 500 Internal Server Error

💡 Hint

The user is authenticated but not allowed to access the resource.

403 Forbidden is used when the user is authenticated but lacks permission to access the resource.