Return 403 instead of 401 for missing authentication

According to the RFC this is only useful for services that use HTTP's
built in authentication schemes. We don't so we can't use this code.

References: https://tools.ietf.org/html/rfc7235

Signed-off-by: Florian Pritz <bluewind@xinu.at>

2 files changed, 2 insertions, 2 deletions

diff --git a/application/controllers/user.php b/application/controllers/user.php
index ab411d7d2..891ef9451 100644
--- a/application/controllers/user.php
+++ b/application/controllers/user.php
@@ -38,7 +38,7 @@ class User extends MY_Controller {
 		if ($this->muser->login($username, $password)) {
 			$this->output->set_status_header(204);
 		} else {
-			$this->output->set_status_header(401);
+			$this->output->set_status_header(403);
 		}
 	}
 
diff --git a/application/exceptions/NotAuthenticatedException.php b/application/exceptions/NotAuthenticatedException.php
index de26318d8..99ddd82fc 100644
--- a/application/exceptions/NotAuthenticatedException.php
+++ b/application/exceptions/NotAuthenticatedException.php
@@ -9,6 +9,6 @@ namespace exceptions;
 class NotAuthenticatedException extends UserInputException {
 	public function get_http_error_code()
 	{
-		return 401;
+		return 403;
 	}
 }