2

I know that if user is forbidden in an admin's area, I should return 401 or 403 status error code. However, what I want to prohibit an admin for accessing a user's dashboard also? An admin has its own dashboard where he can already see a list of users, hence access to a user's dashboard wouldn't make sense.

What error code should I return? It's kind of not prohibited, hence it's nor 401 or 403, but somehow wrong -- how to express this in the term of http error code?

Improve this question
2
  • 2
    There are only a few dozen 4xx HTTP status codes. That isn't enough granularity to distinguish between what are nearly synonyms.
    – whatsisname
    Dec 6, 2017 at 5:22
  • 1
    curious .. why forbid the admin from accessing the user's dashboard. Is there information on the user's dashboard that the admin should not be allowed to see or is it just because the admin already has a different way to access that same information and this one sounds superfluous to you. If your case is the latter it sounds to me you adding complexity and get very little functionality in return so why bother... after all... (s)he IS the admin
    – Newtopian
    Dec 6, 2017 at 17:33

1 Answer 1

Reset to default
12

That sounds like a straightforward 403

You are implementing a rule to ban access to a resource for an unauthorised user - that's a 403

Improve this answer
1
  • 4
    agree: I agree with @mgh42: see authorized vs. authenticated. 401 is about a simple error that the webserver can detect (like not logged in), whereas 403 is an application-level error for that user. "In summary, a 401 Unauthorized response should be used for missing or bad authentication, and a 403 Forbidden response should be used afterwards, when the user is authenticated but isn’t authorized to perform the requested operation on the given resource."
    – Erik Eidt
    Dec 6, 2017 at 4:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.