Error 403(Forbidden) and Error 401 (Unauthorized) are almost like identical twins, but what do you think is the exact difference between the two?
RFC Standards
The RFC Standard defining Error 401 (Unauthorized) is RFC7235 which says that the code conveys the message indicating the canceled request because of lacking authentication credentials for the target resource… You could then try to repeat the request with a new or replaced Authorization header field.
But, the RFC standard that defines Error 403 (Forbidden) is RFC 7231 and it states that the server has successfully understood the request but has refused to authorize it. The authorization credentials that were provided in the request are insufficient for the server to provide access.
Main Causes Of The Errors
So now we know, that Error 403 happens when the user has logged in but they do not have the permission required to access the requested resource. For instance, you could be logging in to access the admin route when you only have permission for the generic user route.
On the other hand, you will mostly encounter a 401 error when you have provided the wrong password or you have not logged in at all.
These, we can say, are the most common causes for Errors 401 and 403.
Some Obscure Causes
There are a few occasions when the cause for the error might not be that straightforward.
There can be occasions when the error 403 is not entirely dependent on the logged-in user’s credentials.
For instance, there could be a server that has locked down its resources such that it only allows access from a fixed range of IP addresses. The VPN could be potentially circumvented with the latter.
On the other hand, even if you have entered the correct credentials, the 401 error could occur. But, it has to be admitted that this could only be encountered while developing authenticated back ends of your own. But a malformed authorization header will again return a 401.
For instance, you might want to include in the request, a JWT (JSON Web Token), if you have it. A JWT expects the format Authorization: Bearer eyJhbGci......yJV_adQssw5c.
You could encounter the 401 error if you forget to use the word “Bearer’ before the JWT.
