Which status code is used when authentication credentials are missing or invalid?

Which status code is used when authentication credentials are missing or invalid?

• A. 400 - Bad Request
• B. 401 - Unauthorized
• C. 403 - Forbidden
• D. 404 - Not Found

Answer: (B)

When a service requires authentication, the response status communicates the state of the credentials. If credentials are missing or invalid, the best choice is a 401 Unauthorized. This signals that access hinges on providing valid authentication, and the client should reattempt authentication (often after receiving a challenge via the WWW-Authenticate header) to proceed. If the client has already provided credentials but they are not sufficient to access the resource, a 401 is still the appropriate signal to re-authenticate. In contrast, 403 Forbidden means the client is authenticated but not permitted to access the resource, which is a different situation. 400 Bad Request is used for malformed requests, not specifically for authentication issues, and 404 Not Found indicates the resource doesn’t exist, again not about credentials.

When a service requires authentication, the response status communicates the state of the credentials. If credentials are missing or invalid, the best choice is a 401 Unauthorized. This signals that access hinges on providing valid authentication, and the client should reattempt authentication (often after receiving a challenge via the WWW-Authenticate header) to proceed. If the client has already provided credentials but they are not sufficient to access the resource, a 401 is still the appropriate signal to re-authenticate. In contrast, 403 Forbidden means the client is authenticated but not permitted to access the resource, which is a different situation. 400 Bad Request is used for malformed requests, not specifically for authentication issues, and 404 Not Found indicates the resource doesn’t exist, again not about credentials.