401 مقابل 403 وأجسام الأخطاء

في هذا الدرس

return the right status with a clear Problem Details body.

الموضوعات المخطط لها

• 401 Unauthorized: "I do not know who you are" (missing or bad credentials). Despite the name, it is about authentication.
• 403 Forbidden: "I know who you are, but you may not do this."
• Configure authenticationEntryPoint for 401 and accessDeniedHandler for 403.
• Return application/problem+json using ProblemDetail so errors match the rest of the API.
• Do not leak detail: no stack traces, no "user does not exist".