Forbidden
ActiveHTTP 403 Forbidden indicates the server understood the request but refuses to fulfill it. Defined in RFC 9110 §15.5.4. The client does not have permission to access this resource, and re-authenticating will not help.
Description
The 403 Forbidden status code indicates that the server understood the request but refuses to fulfill it. If authentication credentials were provided, the server considers them insufficient to grant access.
Key distinction: 401 means 'who are you?' (authentication). 403 means 'I know who you are, but you can't do this' (authorization).
Examples
DELETE /api/users/1 HTTP/1.1
Host: api.example.com
Authorization: Bearer user-token-123HTTP/1.1 403 Forbidden
Content-Type: application/json
{"error": "forbidden", "message": "Only administrators can delete user accounts"}Edge Cases
- •Some servers use 403 to hide resource existence (instead of 404) for security.
- •IP-based restrictions (geo-blocking) often manifest as 403.
- •A 403 on a directory listing may mean directory browsing is disabled.
When You'll See This
- →User tries to access admin-only resources
- →API key lacks required scope
- →IP address is blocked
- →File system permissions prevent access
Implementation References
| Language | Constant |
|---|---|
| Go | http.StatusForbidden |
| Rust | http::StatusCode::FORBIDDEN |
| Python | http.HTTPStatus.FORBIDDEN |
| Node.js | http.STATUS_CODES[403] |
| .NET | HttpStatusCode.Forbidden |
| Java | HttpURLConnection.HTTP_FORBIDDEN |
History
Present since HTTP/1.0 (RFC 1945, 1996). The confusion between 401 and 403 has been a source of developer errors since the beginning.
Related Status Codes
Related Headers
FAQ
What is the difference between 401 and 403?
401 means not authenticated (provide credentials). 403 means authenticated but not authorized (you don't have permission).
Should I return 403 or 404 for sensitive resources?
Use 404 if revealing existence is a security concern. Use 403 if the user should know it exists but lacks permission.