ServiceStack Authentication Error Codes

Question

Before i've always catch up every authentication xhr request rejection globally.

The status codes was the following:

401: not Authenticated
403: not Authorized
419: sessionTimeout
440: sessionTimeout

Using the CredentialsAuthProvider i get an 401 for a invalid username or password for a login request. For [Authenticate] 401 Unauthorized. What can i except for 403, 419, 440 sessionTimeout etc. Thanks for your support.

Answer 1

The 403 Forbidden is returned when Users are authenticated but they don't have authorization to use a Service, e.g. they don't have the necessary Roles or Permissions.

Session Timeouts are never thrown in ServiceStack as Sessions are automatically removed when they're expired by the back-end Caching Provider which results in the same state as never having a session at all, so it returns 401 Unauthorized.

Wikipedia has a good list of the different HTTP Status codes and their meaning.