From 2e7269f566a0204dbc83d6c8f423886e27d60363 Mon Sep 17 00:00:00 2001 From: Florian Pritz Date: Fri, 29 Jul 2016 11:17:06 +0200 Subject: Return 403 instead of 401 for missing authentication According to the RFC this is only useful for services that use HTTP's built in authentication schemes. We don't so we can't use this code. References: https://tools.ietf.org/html/rfc7235 Signed-off-by: Florian Pritz --- application/controllers/user.php | 2 +- application/exceptions/NotAuthenticatedException.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/application/controllers/user.php b/application/controllers/user.php index ab411d7d2..891ef9451 100644 --- a/application/controllers/user.php +++ b/application/controllers/user.php @@ -38,7 +38,7 @@ class User extends MY_Controller { if ($this->muser->login($username, $password)) { $this->output->set_status_header(204); } else { - $this->output->set_status_header(401); + $this->output->set_status_header(403); } } diff --git a/application/exceptions/NotAuthenticatedException.php b/application/exceptions/NotAuthenticatedException.php index de26318d8..99ddd82fc 100644 --- a/application/exceptions/NotAuthenticatedException.php +++ b/application/exceptions/NotAuthenticatedException.php @@ -9,6 +9,6 @@ namespace exceptions; class NotAuthenticatedException extends UserInputException { public function get_http_error_code() { - return 401; + return 403; } } -- cgit v1.2.3-24-g4f1b