Authorization in RESTful HTTP API, 401 WWW-Authenticate

To answer your questions: How to deal with unauthorized requests? The way you described it is pretty much the recommended way for a RESTful service. As far as I can see there is absolutely nothing wrong with that. What WWW-Authenticate header should 401 responses supply? In general the WWW-Authenticate header tells the client what kind … Read more

Is it possible to send a 401 Unauthorized AND redirect (with a Location)?

By definition (see RFC 2616), the HTTP 302 response code is the redirect code. Without it, the location header may be ignored. However, you can send an HTTP 401 response and still display output. Instead of redirecting the user to an error page, you could simply write your content you want to send in the … Read more

Unable to get windows authentication to work through local IIS

You have to whitelist a domain specified in the hosts file in order for windows authentication to work: Click Start, click Run, type regedit, and then click OK. In Registry Editor, locate the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters Right-click Parameters, click New, and then click DWORD (32-bit) Value. Type DisableStrictNameChecking and press ENTER. Double-click the DisableStrictNameChecking … Read more

How do I get the HTTP status code with jQuery?

this is possible with jQuery $.ajax() method $.ajax(serverUrl, { type: OutageViewModel.Id() == 0 ? “POST” : “PUT”, data: dataToSave, statusCode: { 200: function (response) { alert(‘1’); AfterSavedAll(); }, 201: function (response) { alert(‘1’); AfterSavedAll(); }, 400: function (response) { alert(‘1’); bootbox.alert(‘<span style=”color:Red;”>Error While Saving Outage Entry Please Check</span>’, function () { }); }, 404: function … Read more

401 Unauthorized: Access is denied due to invalid credentials

I realize this is an older post but I had the same error on IIS 8.5. Hopefully this can help another experiencing the same issue (I didn’t see my issue outlined in other questions with a similar title). Everything seemed set up correctly with the Application Pool Identity, but I continued to receive the error. … Read more

403 Forbidden vs 401 Unauthorized HTTP responses

A clear explanation from Daniel Irvine [original link]: There’s a problem with 401 Unauthorized, the HTTP status code for authentication errors. And that’s just it: it’s for authentication, not authorization. Receiving a 401 response is the server telling you, “you aren’t authenticated–either not authenticated at all or authenticated incorrectly–but please reauthenticate and try again.” To … Read more