4

I know that if user is forbidden in an admin's area, I should return 401 or 403 status error code. However, what I want to prohibit an admin for accessing a user's dashboard also? An admin has its own dashboard where he can already see a list of users, hence access to a user's dashboard wouldn't make sense.

What error code should I return? It's kind of not prohibited, hence it's nor 401 or 403, but somehow wrong -- how to express this in the term of http error code?

2
  • 6
    There are only a few dozen 4xx HTTP status codes. That isn't enough granularity to distinguish between what are nearly synonyms. Commented Dec 6, 2017 at 5:22
  • 3
    curious .. why forbid the admin from accessing the user's dashboard. Is there information on the user's dashboard that the admin should not be allowed to see or is it just because the admin already has a different way to access that same information and this one sounds superfluous to you. If your case is the latter it sounds to me you adding complexity and get very little functionality in return so why bother... after all... (s)he IS the admin
    – Newtopian
    Commented Dec 6, 2017 at 17:33

3 Answers 3

16

That sounds like a straightforward 403

You are implementing a rule to ban access to a resource for an unauthorised user - that's a 403

1
  • 4
    agree: I agree with @mgh42: see authorized vs. authenticated. 401 is about a simple error that the webserver can detect (like not logged in), whereas 403 is an application-level error for that user. "In summary, a 401 Unauthorized response should be used for missing or bad authentication, and a 403 Forbidden response should be used afterwards, when the user is authenticated but isn’t authorized to perform the requested operation on the given resource."
    – Erik Eidt
    Commented Dec 6, 2017 at 4:48
1

401 should be returned if authentication is missing, and if the same request with the right authentication added would succeed.

403 should be returned if this request, issued by this requester, can never succeed.

Note that neither situation should give any other information to the requester. So if I am looking for a non-existing resource inside a folder that I cannot access, 401/403 should be returned and not an error that the resource is missing.

1

In addition to the other answers - consider returning 404 in these sort of use cases as well. If you return 404 when the user doesn't exist, doing otherwise when you can't access their dashboard leaks information to adversaries.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.