| Previous | Next |
| HTTP_STATUS_PAYMENT_REQ | HTTP_STATUS_NOT_FOUND |
HTTP_STATUS_FORBIDDEN
HTTP_STATUS_FORBIDDEN represents HTTP 403 Forbidden. The server understood the request but refuses to fulfill it. Unlike 401 Unauthorized, a 403 response does not establish that the problem can be solved by selecting an authentication challenge and supplying new credentials; RFC 9110 explicitly allows a server to use 403 when credentials are present but insufficient.
What to diagnose
Start with the application or server policy that made the authorization decision. Relevant inputs can include the authenticated identity, resource ownership, HTTP method, virtual-host or route configuration, network policy, and application-level state. If a reverse proxy is involved, determine which hop actually generated the 403 before changing origin permissions: a proxy, web application firewall, or origin server can independently refuse the request.
Blind retries normally reproduce the same refusal because the request has already been understood. Compare a failing request with an allowed request at the same endpoint, including method and authentication context. Servers are also permitted to return 404 instead of 403 when they do not wish to reveal that a forbidden resource exists, so the absence of 403 is not proof that authorization was never evaluated.
References
- RFC 9110, 403 Forbidden — refusal semantics, credential handling, and optional use of 404 to hide a resource.
- RFC 9110, 401 Unauthorized — the authentication-challenge status that is commonly confused with 403.
Looking for a different code? Search another status or error code.