401 Unauthorized vs 403 Forbidden in Rest API - Interactive Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to return the correct HTTP status code for unauthorized access.

Rest API

return [1]  # Status code for unauthorized access

Drag options to blanks, or click blank then click option'

A403

B401

C404

D500

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing 401 with 403 status code.

Using 404 instead of 401 for unauthorized access.

The HTTP status code 401 Unauthorized means the user is not authenticated and must provide valid credentials.

2fill in blank

medium

Complete the code to return the correct HTTP status code for forbidden access.

Rest API

return [1]  # Status code for forbidden access

Drag options to blanks, or click blank then click option'

A401

B400

C403

D200

Attempts:

3 left

💡 Hint

Common Mistakes

Using 401 instead of 403 for forbidden access.

Returning 200 OK for forbidden access.

The HTTP status code 403 Forbidden means the user is authenticated but does not have permission to access the resource.

3fill in blank

hard

Fix the error in the code to correctly check if a user is authenticated before returning 401.

Rest API

if not user.is_authenticated:
    return [1]  # Correct status code for unauthorized

Drag options to blanks, or click blank then click option'

A401

B403

C404

D500

Attempts:

3 left

💡 Hint

Common Mistakes

Returning 403 when user is not authenticated.

Returning 404 instead of 401.

The code should return 401 Unauthorized when the user is not authenticated.

4fill in blank

hard

Fill both blanks to return 403 when user lacks permission and 401 when not authenticated.

Rest API

if not user.is_authenticated:
    return [1]  # Unauthorized
elif not user.has_permission:
    return [2]  # Forbidden

Drag options to blanks, or click blank then click option'

A401

B403

C404

D200

Attempts:

3 left

💡 Hint

Common Mistakes

Swapping 401 and 403 codes.

Returning 404 for permission errors.

Use 401 for unauthenticated users and 403 for authenticated users without permission.

5fill in blank

hard

Fill all three blanks to create a function that returns 401 if not authenticated, 403 if forbidden, else 200.

Rest API

def check_access(user):
    if not user.[1]:
        return [2]
    elif not user.[3]:
        return 403
    else:
        return 200

Drag options to blanks, or click blank then click option'

Ais_authenticated

B401

Chas_permission

Dis_admin

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong property names like is_admin.

Returning wrong status codes for each case.

The function checks if the user is authenticated (is_authenticated) and returns 401 if not. Then it checks if the user has permission (has_permission) and returns 403 if not. Otherwise, it returns 200 OK.

Practice

1. What does the HTTP status code 401 Unauthorized indicate in a REST API?

easy

A. The client is not authenticated or provided invalid credentials.

B. The client is authenticated but does not have permission to access the resource.

C. The requested resource was not found on the server.

D. The server encountered an internal error while processing the request.

Solution

1. Step 1: Understand the meaning of 401 Unauthorized

   The 401 status code means the client must authenticate itself to get the requested response. It usually means no or bad login info.

2. Step 2: Differentiate from 403 Forbidden

   403 means the client is authenticated but lacks permission. 401 means no valid authentication.

3. Final Answer:

   The client is not authenticated or provided invalid credentials. -> Option A

4. Quick Check:

   401 Unauthorized = No or bad login info [OK]

Hint: 401 means login problem; 403 means no permission [OK]

Common Mistakes:

• Confusing 401 with 403
• Thinking 401 means resource missing
• Assuming 401 means server error

2. Which HTTP status code should a REST API return when a user is logged in but tries to access a resource they don't have rights for?

easy

A. 404 Not Found

B. 401 Unauthorized

C. 403 Forbidden

D. 500 Internal Server Error

Solution

1. Step 1: Identify the meaning of 403 Forbidden

   403 means the user is authenticated but does not have permission to access the resource.

2. Step 2: Confirm 401 is for unauthenticated users

   401 is for users who are not logged in or have invalid credentials, so it does not apply here.

3. Final Answer:

   403 Forbidden -> Option C

4. Quick Check:

   403 Forbidden = Logged in but no permission [OK]

Hint: 403 means permission denied after login [OK]

Common Mistakes:

• Using 401 when user is logged in
• Confusing 403 with 404 Not Found
• Thinking 403 means server error

3. Consider this REST API response scenario:

{"status":401,"message":"Invalid token"}

What does this response tell the client?

medium

A. The client provided an invalid or missing authentication token.

B. The server failed to process the request due to an error.

C. The requested resource does not exist.

D. The client is authenticated but forbidden to access the resource.

Solution

1. Step 1: Analyze the status code 401

   401 means unauthorized, so the client is not properly authenticated.

2. Step 2: Interpret the message "Invalid token"

   This indicates the authentication token is missing or invalid, so the client must provide valid credentials.

3. Final Answer:

   The client provided an invalid or missing authentication token. -> Option A

4. Quick Check:

   401 + "Invalid token" = Bad login info [OK]

Hint: 401 with token error means bad or missing login [OK]

Common Mistakes:

• Thinking 401 means permission denied
• Assuming resource is missing
• Confusing 401 with server error

4. You have this REST API code snippet:

if (!user.isLoggedIn()) {
  return 403;
} else if (!user.hasAccess()) {
  return 401;
}

What is wrong with this code?

medium

A. It returns 401 when user lacks access, should be 403 instead.

B. The code is correct as is.

C. It should return 404 for unauthorized access.

D. It returns 403 when user is not logged in, should be 401 instead.

Solution

1. Step 1: Check the meaning of 401 and 403

   401 means unauthorized (not logged in), 403 means forbidden (no permission).

2. Step 2: Analyze the code logic

   The code returns 403 when user is not logged in, which is incorrect. It should return 401 here. It returns 401 when user lacks access, which should be 403.

3. Final Answer:

   It returns 403 when user is not logged in, should be 401 instead. -> Option D

4. Quick Check:

   Not logged in = 401, no permission = 403 [OK]

Hint: 401 for no login, 403 for no permission [OK]

Common Mistakes:

• Swapping 401 and 403 codes
• Using 404 for unauthorized
• Assuming code is correct without checking status meanings

5. You are designing a REST API for a file storage service. A user tries to access a file:

GET /files/123

The user is logged in but does not own the file. Which status code should your API return and why?

hard

A. 401 Unauthorized, because the user must re-authenticate to access the file.

B. 403 Forbidden, because the user is authenticated but not allowed to access this file.

C. 404 Not Found, to hide the existence of the file from unauthorized users.

D. 500 Internal Server Error, because the server cannot process the request.

Solution

1. Step 1: Determine user's authentication and ownership

   The user is logged in (authenticated) but does not own the file, so lacks permission.

2. Step 2: Choose correct status code for permission denial

   403 Forbidden is the correct code when the user is authenticated but not allowed to access the resource.

3. Final Answer:

   403 Forbidden, because the user is authenticated but not allowed to access this file. -> Option B

4. Quick Check:

   Logged in + no permission = 403 Forbidden [OK]

Hint: Logged in but no access? Return 403 Forbidden [OK]

Common Mistakes:

• Using 401 when user is logged in
• Using 404 to hide resource instead of 403
• Confusing 500 error with permission issues