Hacker News Reader

Comment by redwoolf | Hacker News Reader

I agree. I’ve never run into a situation in my professional work as a software engineer where there has been confusion about these two terms.

The only problem I have is that I can never remember which one maps to HTTP status codes 401 and 403. But that’s just a personal quirk.

Words mean specific things, let’s not dilute or overload the definitions of other words to avoid a confusion that may only exist in the mind of the individual writing the blog.

We already have so many overloaded terms in software engineering.

View on HN

> The only problem I have is that I can never remember which one maps to HTTP status codes 401 and 403. But that’s just a personal quirk.

It's probably because the name of the codes is actually wrong. 401 is called "unauthorized" but actually means "unathenticated" in every situation I've seen it used. 403 is called "forbidden" which is fine, but is synonymous with "unauthorized" in this case.

It isn't that the codes are named wrongly. 401 Unauthorized means you don't have permission to access the page, whether you're authenticated or not. 403 Forbidden means you can never access the page, regardless of permissions. This is typical in multi-tenant setups or when a site is never accessible to unauthenticated users. The distinction is subtle but important, and developers often misuse these codes, serving 403 Forbidden for authorization issues instead of indicating a permanent block.

The MDN docs state this about 401[0]:

> Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response.

[0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#cli...

Like others said, 401 Unauthorized really means unauthenticated. Authentication comes before Authorization, both in the process and alphabetically, and 401 comes before 403. Hope that helps.

I mean more that I always have to look it up to double check. But I like the tip to remember by thinking of the sequence and the numerical order. That does help!

Reply on news.ycombinator.com