"disabled"用户的 HTTP 401 Unauthorized 或 403 Forbidden？

Question

身份验证服务允许禁用用户帐户(一种软删除)。

如果服务器随后收到对禁用用户的身份验证请求，否则该请求是有效的，服务器应该返回 401 还是 403？使用任一状态代码，我都会返回一条消息，指示该帐户已被禁用。

为了快速引用，相关报价来自 HTTP/1.1 spec (强调我的):

401未经授权

The request requires user authentication. The response MUST include aWWW-Authenticate header field (section 14.47) containing a challengeapplicable to the requested resource. The client MAY repeat therequest with a suitable Authorization header field (section 14.8). Ifthe request already included Authorization credentials, then the 401response indicates that authorization has been refused for thosecredentials. If the 401 response contains the same challenge as theprior response, and the user agent has already attemptedauthentication at least once, then the user SHOULD be presented theentity that was given in the response, since that entity mightinclude relevant diagnostic information. HTTP access authenticationis explained in "HTTP Authentication: Basic and Digest AccessAuthentication" [43].

403 禁止访问

The server understood the request, but is refusing to fulfill it.Authorization will not help and the request SHOULD NOT be repeated.If the request method was not HEAD and the server wishes to makepublic why the request has not been fulfilled, it SHOULD describe thereason for the refusal in the entity. If the server does not wish tomake this information available to the client, the status code 404(Not Found) can be used instead.

Answer 1

基于 an email由 Roy T. Fielding 撰写，显然有 a bug在当前的 HTTP 规范中。

规范预期的阅读方式如下(使用上述电子邮件中的引号):

401“未经验证”:

you can't do this because you haven't authenticated

403“未经授权”:

user agent sent valid credentials but doesn't have access

因此，在禁用用户的情况下，403 是正确的响应(404 也是一个选项)。