What does HTTP status 401 (Unauthorized) mean?

HTTP_STATUS_DENIED

HTTP_STATUS_DENIED represents HTTP 401 Unauthorized. The status is specifically about authentication: the server did not apply the request because the request lacks valid authentication credentials for the target resource. A 401 response is therefore different from a general access-policy refusal.

Authentication challenge and retry

RFC 9110 requires a 401 response to contain a WWW-Authenticate field with at least one challenge applicable to the target resource. A client can inspect the advertised authentication scheme and realm, obtain or refresh credentials, and retry with an appropriate Authorization field. Repeating the same request with the same missing or rejected credentials does not address the authentication failure.

For diagnostics, capture the complete response headers rather than only the numeric status. Check which challenge the origin server or intermediary returned, whether the client selected a supported scheme, and whether credentials were sent to the correct origin and protection space. HTTP 403 Forbidden is the closer status when the server understands the request but refuses to fulfill it for reasons other than a missing valid authentication challenge.

References

• RFC 9110, 401 Unauthorized — authentication semantics and the required WWW-Authenticate challenge.
• RFC 9110, WWW-Authenticate — challenge syntax and use in 401 responses.

Looking for a different code? Search another status or error code.