Networking Fundamentals Practice Question 9: HTTP Status Codes
Networking Fundamentals · Test 1 · question 9 of 10
A developer is logged in to an internal web app as a regular user and tries to open the /admin page. The server recognizes who the user is, but the account doesn't have admin rights, and logging in again won't change that. The app does not try to hide the page's existence from signed-in users. Using standard HTTP semantics, which status code should the server return?
Show answer and explanation
Answer:
403 Forbidden means the server understood the request but refuses to fulfil it. The client is known, but it doesn't have permission to access the resource, and re-authenticating makes no difference. That matches an authenticated user without admin rights, so A is correct.
- B. 401 Unauthorized means the request lacks valid authentication credentials, so the client should log in and try again. Despite its name, it is about authentication, not authorization. The user here is already authenticated. - C. 404 Not Found means the server can't find the resource. Some servers deliberately return 404 to hide that a resource exists. That is an optional design choice, though, not the status that describes a permission failure. - D. 400 Bad Request means the request itself is malformed (for example, invalid syntax). Nothing is wrong with this request.
References: MDN - 403 Forbidden; MDN - 401 Unauthorized