The HTTP 403 Forbidden status code indicates that a server understood the request but refuses to authorize it. Unlike authentication errors, the client may already be identified, but the request is blocked due to insufficient permissions, security policies, or access control rules.
A 403 response is returned when a client attempts to access a resource that the server deliberately refuses to provide. The request itself is valid and understood by the server, but the server determines that the requesting entity does not have the necessary authorization to perform the operation.
The difference between 401 Unauthorized and 403 Forbidden is important in access control design.
HTTP/1.1 403 Forbidden Content-Type: text/html Content-Length: 512
The HTTP 403 Forbidden status code signals that the server refuses access to a resource even though the request itself is valid. Understanding the causes of a 403 response is essential when diagnosing authorization failures in modern web applications and APIs.