A logged-in user requests another tenant's invoice. Which status code is most appropriate?
Options
- 401 Unauthorized, because the user is not allowed
- 403 Forbidden (or 404, to hide that it exists) (Correct option)
- 400 Bad Request, because the id is not valid
- 500 Internal Server Error, because the access failed
Answer
403 Forbidden (or 404 to hide existence)
Why
401 means 'I don't know who you are': credentials are missing or invalid (despite its name 'Unauthorized').
403 means 'I know who you are, but you are not allowed to do this'.
The user is logged in but the invoice is not theirs, so 403. Many APIs answer 404 instead, so attackers cannot even learn that the invoice exists.
Remember
401 = who are you? 403 = you can't do that.