401 Unauthorized vs 403 Forbidden in Rest API - Hands-On Comparison

Understanding 401 Unauthorized vs 403 Forbidden in REST APIs

📖 Scenario: You are building a simple REST API server that controls access to a resource. You want to understand the difference between 401 Unauthorized and 403 Forbidden HTTP status codes by simulating them in your API responses.

🎯 Goal: Create a small Python program that simulates API responses with status codes 401 and 403 based on user authentication and permission checks.

📋 What You'll Learn

Create a dictionary called users with usernames as keys and a boolean is_authenticated as values.

Create a variable called resource_permission that stores whether the user has permission to access the resource.

Write a function called check_access that takes a username and returns 401 if the user is not authenticated, 403 if authenticated but no permission, or 200 if access is allowed.

Print the result of check_access for two users: one not authenticated and one authenticated but without permission.

💡 Why This Matters

🌍 Real World

APIs often need to tell clients why access is denied. Using 401 and 403 correctly helps clients understand if they need to log in or if they lack permission.

💼 Career

Backend developers and API designers must know how to use HTTP status codes properly to build secure and user-friendly APIs.

1

Create the users dictionary

Create a dictionary called users with these exact entries: 'alice': False and 'bob': True representing their authentication status.

Rest API

# Create the users dictionary with authentication status
# Your code here

Hint

Use curly braces to create a dictionary and separate entries with commas.

2

Add resource permission variable

Create a variable called resource_permission and set it to False to represent that the user does not have permission to access the resource.

Rest API

users = {'alice': False, 'bob': True}
# Create resource_permission variable and set it to False
# Your code here

Hint

Just assign False to the variable resource_permission.

3

Write the check_access function

Write a function called check_access that takes a parameter username. Inside the function, check if users[username] is False, then return 401. Else if resource_permission is False, return 403. Otherwise, return 200.

Rest API

users = {'alice': False, 'bob': True}
resource_permission = False

# Define check_access function
# Your code here

Hint

Use if and elif statements to check conditions and return the correct status code.

4

Print access check results

Print the result of check_access('alice') and check_access('bob') on separate lines to show the status codes for an unauthenticated user and an authenticated user without permission.

Rest API

users = {'alice': False, 'bob': True}
resource_permission = False

def check_access(username):
    if not users[username]:
        return 401
    elif not resource_permission:
        return 403
    else:
        return 200

# Print the access status for 'alice' and 'bob'
# Your code here

Hint

Use two print statements, one for each user.

Practice

1. What does the HTTP status code 401 Unauthorized indicate in a REST API?

easy

A. The client is not authenticated or provided invalid credentials.

B. The client is authenticated but does not have permission to access the resource.

C. The requested resource was not found on the server.

D. The server encountered an internal error while processing the request.

Solution

1. Step 1: Understand the meaning of 401 Unauthorized

   The 401 status code means the client must authenticate itself to get the requested response. It usually means no or bad login info.

2. Step 2: Differentiate from 403 Forbidden

   403 means the client is authenticated but lacks permission. 401 means no valid authentication.

3. Final Answer:

   The client is not authenticated or provided invalid credentials. -> Option A

4. Quick Check:

   401 Unauthorized = No or bad login info [OK]

Hint: 401 means login problem; 403 means no permission [OK]

Common Mistakes:

• Confusing 401 with 403
• Thinking 401 means resource missing
• Assuming 401 means server error

2. Which HTTP status code should a REST API return when a user is logged in but tries to access a resource they don't have rights for?

easy

A. 404 Not Found

B. 401 Unauthorized

C. 403 Forbidden

D. 500 Internal Server Error

Solution

1. Step 1: Identify the meaning of 403 Forbidden

   403 means the user is authenticated but does not have permission to access the resource.

2. Step 2: Confirm 401 is for unauthenticated users

   401 is for users who are not logged in or have invalid credentials, so it does not apply here.

3. Final Answer:

   403 Forbidden -> Option C

4. Quick Check:

   403 Forbidden = Logged in but no permission [OK]

Hint: 403 means permission denied after login [OK]

Common Mistakes:

• Using 401 when user is logged in
• Confusing 403 with 404 Not Found
• Thinking 403 means server error

3. Consider this REST API response scenario:

{"status":401,"message":"Invalid token"}

What does this response tell the client?

medium

A. The client provided an invalid or missing authentication token.

B. The server failed to process the request due to an error.

C. The requested resource does not exist.

D. The client is authenticated but forbidden to access the resource.

Solution

1. Step 1: Analyze the status code 401

   401 means unauthorized, so the client is not properly authenticated.

2. Step 2: Interpret the message "Invalid token"

   This indicates the authentication token is missing or invalid, so the client must provide valid credentials.

3. Final Answer:

   The client provided an invalid or missing authentication token. -> Option A

4. Quick Check:

   401 + "Invalid token" = Bad login info [OK]

Hint: 401 with token error means bad or missing login [OK]

Common Mistakes:

• Thinking 401 means permission denied
• Assuming resource is missing
• Confusing 401 with server error

4. You have this REST API code snippet:

if (!user.isLoggedIn()) {
  return 403;
} else if (!user.hasAccess()) {
  return 401;
}

What is wrong with this code?

medium

A. It returns 401 when user lacks access, should be 403 instead.

B. The code is correct as is.

C. It should return 404 for unauthorized access.

D. It returns 403 when user is not logged in, should be 401 instead.

Solution

1. Step 1: Check the meaning of 401 and 403

   401 means unauthorized (not logged in), 403 means forbidden (no permission).

2. Step 2: Analyze the code logic

   The code returns 403 when user is not logged in, which is incorrect. It should return 401 here. It returns 401 when user lacks access, which should be 403.

3. Final Answer:

   It returns 403 when user is not logged in, should be 401 instead. -> Option D

4. Quick Check:

   Not logged in = 401, no permission = 403 [OK]

Hint: 401 for no login, 403 for no permission [OK]

Common Mistakes:

• Swapping 401 and 403 codes
• Using 404 for unauthorized
• Assuming code is correct without checking status meanings

5. You are designing a REST API for a file storage service. A user tries to access a file:

GET /files/123

The user is logged in but does not own the file. Which status code should your API return and why?

hard

A. 401 Unauthorized, because the user must re-authenticate to access the file.

B. 403 Forbidden, because the user is authenticated but not allowed to access this file.

C. 404 Not Found, to hide the existence of the file from unauthorized users.

D. 500 Internal Server Error, because the server cannot process the request.

Solution

1. Step 1: Determine user's authentication and ownership

   The user is logged in (authenticated) but does not own the file, so lacks permission.

2. Step 2: Choose correct status code for permission denial

   403 Forbidden is the correct code when the user is authenticated but not allowed to access the resource.

3. Final Answer:

   403 Forbidden, because the user is authenticated but not allowed to access this file. -> Option B

4. Quick Check:

   Logged in + no permission = 403 Forbidden [OK]

Hint: Logged in but no access? Return 403 Forbidden [OK]

Common Mistakes:

• Using 401 when user is logged in
• Using 404 to hide resource instead of 403
• Confusing 500 error with permission issues