HTTP status · 4xx — client error
403 Forbidden
403 Forbidden means the server understood the request but refuses to authorize it.
Key facts
| Class | 4xx — client error |
|---|---|
| Standard | RFC 9110 §15.5.4 |
| Cacheable by default | No |
| Cause | Authorization policy, not missing identity |
| Fix side | Permissions, policy or network allowlist |
What 403 means
The server knows who is asking and still will not allow it. Typical reasons are a missing role or scope, a file or directory permission, a blocked country or IP range, a WAF rule, or an application policy such as “this account cannot export data”. The response may explain why, but servers often keep it vague to avoid leaking policy.
How to diagnose a 403
- Check whether the identity is actually present: a 403 with an anonymous request often means auth middleware ran but the route policy denied the anonymous role.
- Compare with a request that works: same token, different path tells you whether the problem is the policy or the network.
- Look at the edge: CDNs and WAFs return their own 403 pages before your application runs. A body that does not match your app is a strong hint.
- Do not retry with the same credentials — a retry cannot change a policy decision.
Frequently asked questions
What is the difference between 401 and 403?
401 means the server does not have valid authentication. 403 means it does know the requester and refuses access anyway.
Can 403 be caused by a firewall?
Yes. WAFs, CDNs and origin firewalls commonly answer with 403 when a rule blocks the request before it reaches the application.