401 vs 403 and error bodies
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
return the right status with a clear Problem Details body.
Planned topics
- 401 Unauthorized: "I do not know who you are" (missing or bad credentials). Despite the name, it is about authentication.
- 403 Forbidden: "I know who you are, but you may not do this."
- Configure
authenticationEntryPointfor 401 andaccessDeniedHandlerfor 403. - Return
application/problem+jsonusingProblemDetailso errors match the rest of the API. - Do not leak detail: no stack traces, no "user does not exist".
Draft outline details
Demonstration
a ProblemDetail.forStatusAndDetail(HttpStatus.FORBIDDEN, "Access denied") written to the response in the handler.
Check your understanding
Anonymous user calls a protected endpoint. 401 or 403?
Show answer
401.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.