Problem


On the failure of operation due to authentication REST returns 403 instead of 401. Consider following image:

error.png

Here GET on /entity/node/nid is requested with user credentials that does not even exist on the drupal site. Here it should return 401. This becomes confusing for application developer who uses REST for Drupal.

Proposed resolution



401 should be returned if authentication fails. 403 returns if authorization fails for authenticated user. i.e user is authenticated but user is not allowed to perform the operation as per permissions set by drupal administrator. Here permissions can be role based or access based etc.

CommentFileSizeAuthor
error.png39.76 KBvivekvpandya

Comments

vivekvpandya created an issue. See original summary.

vivekvpandya’s picture

Issue summary: View changes
a.milkovsky’s picture

REST returns 403 instead of 403

Please fix the error code in description.

vivekvpandya’s picture

Issue summary: View changes
wim leers’s picture