HTTP Status Codes

403 Forbidden

The server understood the request and knows who you are, but you are not allowed to do it. An authorization failure, distinct from the authentication failure of 401.

What it means

403 Forbidden means access is denied and re-authenticating will not help — the identity simply lacks permission. Unlike 401, there is no WWW-Authenticate challenge. Sometimes a 404 is preferred to avoid revealing that a resource exists.

HTTP RESPONSE
HTTP/1.1 403 Forbidden
Content-Type: application/problem+json

{ "title": "Insufficient scope", "status": 403 }

Why it matters

  • It correctly signals an authorization boundary, so clients do not pointlessly retry with fresh credentials.
  • Choosing 403 vs 404 for hidden resources is an information-disclosure decision.

Common mistakes

  • Using 403 when the user is simply not authenticated (should be 401).
  • Leaking resource existence via 403 where a 404 would be safer.

How WebInspect checks this

  • WebInspect reports 403 responses and, in the API Inspector, evaluates authorization signalling.