What is the difference between HTTP 401 and 403?
⚡
Quick Answer
401 Unauthorized means you are not authenticated (missing/invalid/expired credentials or token) — re-authenticate. 403 Forbidden means you are authenticated but not authorized for this resource — a permissions/policy problem.
Detailed Answer
401 = "who are you?" — the request lacked valid auth; provide a valid token or re-login. 403 = "I know who you are, but you cannot do this" — the identity is valid but lacks the required role/permission, so fix RBAC/policy, not credentials. Confusing the two sends you debugging the wrong layer.
💡
Interview Tip
One-liner: 401 = not authenticated, 403 = authenticated but not authorized. Getting the direction right is the whole point.
httpauth401403security