On a members-only website, an ordinary member who is logged in requests a page that only administrators may access. The server knows who the user is but does not allow access to this page. Which of the following status codes is most appropriate to return?

Answer: B. 403 Forbidden

403 Forbidden indicates that the server understood the request but refuses to allow access. Despite its name, 401 Unauthorized is the code for missing or invalid authentication information, and the WWW-Authenticate header tells the client how to authenticate. Here the server has confirmed who the user is and what is lacking is permission (authorization), so 403 applies. Some designs deliberately return 404 to avoid revealing that an admin page exists, but the code that describes the situation as it is is 403.

• A. 401 is used when authentication information is missing or invalid. This user has already authenticated.
• B. Correct. It indicates that the user is authenticated but lacks permission.
• C. 404 indicates that the resource was not found. Some designs use it to hide a page's existence, but the code that describes the situation as it is is 403.