401 Unauthenticated, 403 Unauthorized?

• From: Miles Crawford <mcrawfor@u.washington.edu>
• Date: Thu, 22 May 2008 16:46:13 +0000
• To: ietf-http-wg@w3.org
• Message-ID: <5c3f36010805220945y386d79c9w4fe1db632ebe19ae@mail.gmail.com>

Has any thought been given to changing the wording for these status codes?

Presently, 401 is called "Unauthorized" and then proceeds to describe
being unauthenticated.  403, ambiguously called "Forbidden" describes
being unauthorized.

-miles

Received on Wednesday, 28 May 2008 14:29:15 UTC