In the API code snippet that performs a GET request and prints result content, which HTTP status would you expect from a forbidden resource?

In the API code snippet that performs a GET request and prints result content, which HTTP status would you expect from a forbidden resource?

• A. 200 - OK
• B. 403 - FORBIDDEN
• C. 404 - NOT FOUND
• D. 500 - SERVER ERROR

Answer: (B)

Access control is shown by HTTP status codes. If a resource exists but the client isn’t allowed to access it, the server returns 403 Forbidden, signaling that authentication may be present but the client lacks the necessary permissions. A 200 OK would indicate the request succeeded and content was returned, which isn’t the case for a restricted resource. A 404 Not Found means the resource doesn’t exist at that location, not simply that access is blocked. A 500 Server Error points to a problem on the server, not an access control issue. So for a resource you’re not allowed to access, 403 Forbidden is the appropriate response.

Access control is shown by HTTP status codes. If a resource exists but the client isn’t allowed to access it, the server returns 403 Forbidden, signaling that authentication may be present but the client lacks the necessary permissions. A 200 OK would indicate the request succeeded and content was returned, which isn’t the case for a restricted resource. A 404 Not Found means the resource doesn’t exist at that location, not simply that access is blocked. A 500 Server Error points to a problem on the server, not an access control issue. So for a resource you’re not allowed to access, 403 Forbidden is the appropriate response.