401 Unauthorized vs 403 Forbidden in Rest API - Interactive Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to return the correct HTTP status code for unauthorized access.

Rest API

return [1]  # Status code for unauthorized access

Drag options to blanks, or click blank then click option'

A403

B401

C404

D500

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing 401 with 403 status code.

Using 404 instead of 401 for unauthorized access.

The HTTP status code 401 Unauthorized means the user is not authenticated and must provide valid credentials.

2fill in blank

medium

Complete the code to return the correct HTTP status code for forbidden access.

Rest API

return [1]  # Status code for forbidden access

Drag options to blanks, or click blank then click option'

A401

B400

C403

D200

Attempts:

3 left

💡 Hint

Common Mistakes

Using 401 instead of 403 for forbidden access.

Returning 200 OK for forbidden access.

The HTTP status code 403 Forbidden means the user is authenticated but does not have permission to access the resource.

3fill in blank

hard

Fix the error in the code to correctly check if a user is authenticated before returning 401.

Rest API

if not user.is_authenticated:
    return [1]  # Correct status code for unauthorized

Drag options to blanks, or click blank then click option'

A401

B403

C404

D500

Attempts:

3 left

💡 Hint

Common Mistakes

Returning 403 when user is not authenticated.

Returning 404 instead of 401.

The code should return 401 Unauthorized when the user is not authenticated.

4fill in blank

hard

Fill both blanks to return 403 when user lacks permission and 401 when not authenticated.

Rest API

if not user.is_authenticated:
    return [1]  # Unauthorized
elif not user.has_permission:
    return [2]  # Forbidden

Drag options to blanks, or click blank then click option'

A401

B403

C404

D200

Attempts:

3 left

💡 Hint

Common Mistakes

Swapping 401 and 403 codes.

Returning 404 for permission errors.

Use 401 for unauthenticated users and 403 for authenticated users without permission.

5fill in blank

hard

Fill all three blanks to create a function that returns 401 if not authenticated, 403 if forbidden, else 200.

Rest API

def check_access(user):
    if not user.[1]:
        return [2]
    elif not user.[3]:
        return 403
    else:
        return 200

Drag options to blanks, or click blank then click option'

Ais_authenticated

B401

Chas_permission

Dis_admin

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong property names like is_admin.

Returning wrong status codes for each case.

The function checks if the user is authenticated (is_authenticated) and returns 401 if not. Then it checks if the user has permission (has_permission) and returns 403 if not. Otherwise, it returns 200 OK.