401 vs 403, the difference in one request

401 and 403 get swapped constantly, and the fix is one question: is the server failing to identify you, or refusing you? Step through the scene above and the two stop blurring together.

Two gates, in order

Every protected request passes two checks. Authentication asks "who are you?" and authorization asks "may you do this?". They run in that order, and each has its own failure code.

• 401 Unauthorized is the authentication gate. The server cannot tell who you are: no credential, an expired session, an invalid token. Signing in fixes it.
• 403 Forbidden is the authorization gate. The server knows exactly who you are and the answer is still no. Signing in again changes nothing.

Why the distinction matters

Return the wrong one and you send the reader down the wrong path: a 403 dressed up as a 401 tells a user to log in again forever, and a 401 dressed up as a 403 hides a plain "your session expired".

function requireOwner(req, res, next) {
  if (!req.user) return res.sendStatus(401); // no identity
  if (req.user.id !== req.order.ownerId) return res.sendStatus(403); // not allowed
  next();
}

The status code is the whole message here. The MDN reference on 403 covers the edge cases; the lesson builds the ownership check that decides between the two.