403
ELI5 — The Vibe Check
403 Forbidden means 'I know who you are, but you're not allowed in here.' You're authenticated but not authorized. It's like being a regular employee trying to enter the CEO's private office — they know you, but no.
Real Talk
HTTP 403 Forbidden indicates the server understood the request and knows who the client is (authenticated), but refuses to authorize access to the requested resource. It's an authorization failure, distinct from 401 which is an authentication failure.
When You'll Hear This
"Non-admin users get a 403 on the admin endpoint." / "401 is 'who are you?' — 403 is 'I know who you are, still no.'"
Related Terms
401
401 Unauthorized means 'who are you? Log in first.' You haven't proven your identity.
Authorization (AuthZ)
Authorization is deciding what you're allowed to do after you've proven who you are.
Middleware
Middleware is like a security checkpoint at an airport.
Status Code
An HTTP status code is the server's one-line verdict on your request. 200 means 'perfect, here's what you asked for.' 404 means 'can't find it.