Which HTTP status code to say username or password were incorrect?

Question

I am implementing a simple registation/login module.

While testing user credentials, I start thinking which HTTP status code will be appropriate, for the situation if a user send a request with incorrect credentials.

At first, I thought 401 Unauthorized would be a nice status code, but it seems it will be better to use it when a user is trying to get some resource without authorisation.

After, I switched to 409 Conflict

This code is only allowed in situations where it is expected that the user might be able to resolve the conflict and resubmit the request.

So, friends, please give me an advise, which status code should be used.

using a resource without authorization should be a 403 Forbidden. — Jeremy Holovacs, Oct 24 '18 at 12:30

score 34 · Accepted Answer · answered Sep 29 '14 at 08:17

34

If you use HTTP authentication as defined by RFC 7235, 401 would be correct (for missing or incorrect credentials).

Otherwise, use 403.

answered Sep 29 '14 at 08:17

Julian Reschke

35,455
7
78
83

Which HTTP status code to say username or password were incorrect?

1 Answers1

Linked

Related