Client application needs to call a public endpoint (no token required) in order to valid (GET) a specific TOKEN previously remember within the SPA application.
- If token is valid a status code 200 is returned and a json value
- If token is malformed a status code code 200 is returned and a json value
- If token is unauthorized a status code code 200 is returned and a json value
I would like to know:
- Has the backed developer designed correctly API?
- For malformed token should API return instead a generic 400 (“Bad Request”) and for 401 (“Unauthorized”) for token which is not unauthorized.
Please note: This question is not the just about status code, my concern is regarding the design of a public endpoint which provide information to client application where the endpoint does not require authentication using token.