Recall & Review
beginner
What does the HTTP status code 401 Unauthorized mean?
It means the user is not authenticated. The server requires valid login credentials before allowing access.
Click to reveal answer
beginner
What does the HTTP status code 403 Forbidden mean?
It means the user is authenticated but does not have permission to access the requested resource.
Click to reveal answer
intermediate
When should a server respond with 401 Unauthorized instead of 403 Forbidden?
When the user has not provided valid credentials or is not logged in yet.
Click to reveal answer
intermediate
When should a server respond with 403 Forbidden instead of 401 Unauthorized?
When the user is logged in but does not have rights to access the resource.
Click to reveal answer
beginner
Give a real-life example to explain the difference between 401 and 403.
Imagine a locked building: 401 is like not having a key to enter (need to prove who you are). 403 is like having a key but not allowed in a certain room inside.
Click to reveal answer
What does a 401 Unauthorized status code indicate?
✗ Incorrect
401 means the user needs to provide valid credentials to access the resource.
Which status code means the user is authenticated but lacks permission?
✗ Incorrect
403 means the user is recognized but not allowed to access the resource.
If a user tries to access a page without logging in, which status code should the server return?
✗ Incorrect
401 is used when authentication is required but missing.
If a logged-in user tries to access an admin page without rights, what status code applies?
✗ Incorrect
403 indicates the user is authenticated but forbidden from accessing the resource.
Which status code should NOT be used when the user is not logged in?
✗ Incorrect
403 is for authenticated users without permission, not for unauthenticated users.
Explain the difference between 401 Unauthorized and 403 Forbidden in your own words.
Think about needing a key to enter a building versus being denied access to a room inside.
You got /3 concepts.
When designing a REST API, how do you decide whether to return 401 or 403 for a request?
Authentication first, then authorization.
You got /3 concepts.