What is the difference between 401 Unauthorized and 403 Forbidden?
Learn the difference between 401 Unauthorized and 403 Forbidden: 401 means not authenticated, 403 means authenticated but not permitted to access the resource.
Expected Interview Answer
401 Unauthorized means the request lacks valid authentication — the server does not know who you are — while 403 Forbidden means you are authenticated but not allowed to access the resource.
401 is about authentication (identity): credentials are missing, invalid or expired, so the server responds with a WWW-Authenticate header inviting the client to supply valid credentials. 403 is about authorization (permission): the server has accepted who you are but the identity lacks the rights to perform the action, and re-authenticating will not help. In short, 401 says 'log in', and 403 says 'you are logged in but you still cannot do this'.
- Separates identity failures from permission failures
- Guides the client on whether to prompt for login
- 401 triggers the standard WWW-Authenticate challenge flow
- 403 avoids leaking that valid credentials would grant access
- Improves audit clarity for security reviews
AI Mentor Explanation
Picture the entrance to a cricket stadium. If you show up with no ticket at all, security stops you at the gate — that is 401, you have not proven you belong here. But if you hold a general stand ticket and try to walk into the players' dressing room, staff turn you away even though your ticket is genuine — that is 403: your identity is verified, you simply lack the access level for that area.
Step-by-Step Explanation
Step 1
Check authentication first
If no valid credentials are present, the server cannot identify the caller — this is a 401 situation.
Step 2
Return 401 with a challenge
Respond 401 Unauthorized and include a WWW-Authenticate header telling the client how to authenticate.
Step 3
Authenticate the identity
The client supplies credentials (token, cookie, key); the server verifies who the caller is.
Step 4
Check authorization
With a known identity, evaluate whether that identity has permission for the requested resource or action.
Step 5
Return 403 if not permitted
If the authenticated identity lacks rights, respond 403 Forbidden — re-authenticating will not change the outcome.
What Interviewer Expects
- Authentication versus authorization distinction
- 401 = who are you, 403 = you are known but not allowed
- Knowledge of the WWW-Authenticate header on 401
- Understanding that re-login fixes 401 but not 403
- Awareness that 404 is sometimes used to hide 403 for security
Common Mistakes
- Using 401 when the user is authenticated but lacks permission
- Returning 403 for missing or expired tokens
- Omitting the WWW-Authenticate header on a 401 response
- Believing re-authentication resolves a 403
- Confusing authentication with authorization entirely
Best Answer (HR Friendly)
“A 401 means the system does not know who you are, so you need to log in with valid credentials. A 403 means it does know who you are, but your account simply is not allowed to do that particular thing.”
Code Example
function auth(req, res, next) {
const token = req.headers.authorization
if (!token || !isValid(token)) {
// No/invalid credentials -> not authenticated
res.set('WWW-Authenticate', 'Bearer')
return res.status(401).json({ error: 'Authentication required' })
}
req.user = decode(token)
next()
}
function requireAdmin(req, res, next) {
if (req.user.role !== 'admin') {
// Known identity, but not permitted
return res.status(403).json({ error: 'You do not have access' })
}
next()
}Follow-up Questions
- Which header must accompany a 401 response?
- When might you return 404 instead of 403 and why?
- How does an expired JWT typically map to 401 or 403?
- Is authorization or authentication checked first, and why?
- How do refresh tokens relate to recovering from a 401?
MCQ Practice
1. A user with a valid token requests a resource their role cannot access. What status is correct?
The user is authenticated but lacks permission, so 403 Forbidden is correct; re-authenticating would not help.
2. Which header should a 401 response include?
A 401 must include WWW-Authenticate to tell the client how to authenticate.
3. An expired access token that fails verification typically results in?
An expired or invalid token means the caller is not authenticated, which maps to 401 so the client can obtain fresh credentials.
Flash Cards
401 Unauthorized means? — Not authenticated — missing or invalid credentials; the server does not know who you are.
403 Forbidden means? — Authenticated but not authorized — the server knows you but you lack permission.
Does re-login fix a 403? — No. 403 is about permissions, not identity; re-authenticating does not grant access.
Which header goes with 401? — WWW-Authenticate, telling the client how to supply valid credentials.
Authentication vs authorization? — Authentication proves identity (401 when it fails); authorization grants permission (403 when it fails).