What is the difference between HTTP 401 and 403?
Assesses fundamental understanding of REST API Design conventions, runtime behavior, and memory/performance considerations.
Hiring managers look for precision, avoidance of ambiguous jargon, and ability to explain trade-offs under real production conditions.
401 Unauthorized means the request lacks valid authentication credentials. The client should authenticate and retry, and the response should include a WWW-Authenticate header describing the scheme.
403 Forbidden means the server understood the request and knows who the caller is, but the caller is not allowed to perform it. Re-authenticating will not help; the identity simply lacks permission.
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api"
Practical mapping: a missing or expired token gives 401, while a valid token with an insufficient role gives 403. For sensitive resources, many APIs return 404 instead of 403 so attackers cannot learn whether a resource exists. Avoid returning 400 for permission failures, because it hides the real cause from clients and monitoring.
Candidate Response Strategy & Interview Tips
- Start with a concise one-sentence summary: Deliver a direct, confident answer first before expanding into nuances.
- Demonstrate real-world trade-offs: Discuss where this approach excels and when you would avoid it in production systems.
- Discuss complexity & edge cases: Proactively explain time/space complexity or boundary conditions (null values, scale limits).
- Prepare for interviewer follow-ups: Technical hiring panels frequently probe deeper into concurrency, backward compatibility, or alternative libraries.