403 Forbidden vs 401 Unauthorized HTTP responses In summary, a 401 Unauthorized response should be used for missing or bad authentication, and a 403 Forbidden response should be used afterwards, when the user is authenticated but isn’t authorized to perform the requested operation on the given resource Another nice pictorial format of how http status codes should be used
c# - ASP. NET Web API : Correct way to return a 401 unauthorised . . . All the relevant controllers have the right attributes, and authentication is working ok The problem is that not all of the request can be authorised in the scope of an attribute - some authorisation checks have to be performed in code that is called by controller methods - what is the correct way to return a 401 unauthorised response in this
ASP. NET Calling WebMethod with jQuery AJAX 401 (Unauthorized) 6 401 Unauthorised means that: User authentication hasn't been provided or It was provided but failed authentication tests This corroborates with what you've said about adding authentication, it's clearly covering this method too Therefore do you want access to this method to be public or not? Public: You need to remove authentication from
cors - HTTP Post Request: 401 (Unauthorized) - Stack Overflow The fact that you receive 401 and the other guy got 403 is irrelevant - the fundamental issue is the same and the difference is a result of your having different servers with different CORS middleware