HTTP Status Code for Authenticated but Unauthorized?

With which HTTP status code should a REST API respond if the request is authenticated (according to The OAuth 2.0 Authorization Framework: Bearer Token Usage: Authorization Request Header Field) but the authenticated user is unauthorized to view the resource being requested?

For example, imagine I make a request to see a certain user's profile: GET /users/123 . I authenticate successfully, but that user has blocked me. With which HTTP status code should the server respond?

Related:

Authentication versus Authorization

HTTP status code for missing authentication

---

The code you need is 403 Forbidden :

From wikipedia:

A 403 response generally indicates one of two conditions:

Authentication was provided, but the authenticated user is not permitted to perform the requested operation.

The operation is forbidden to all users. For example, requests for a directory listing return code 403 when directory listing has been disabled.

链接地址: http://www.djcxy.com/p/22244.html

上一篇: 身份验证v / s授权

下一篇: HTTP状态代码进行身份验证但未经授权？