Kindlehighlight Quote by Paul Dix
““For invalid user name and password combinations, the service should return a 400 HTTP status code, which means that the server received a “bad request.” The service could also use the 401 (“unauthorized”) response code, but that code specifies that authentication credentials need to be in the request header, which is not quite what is required.””
About This Quote
The technical note explains why a 400 status is appropriate for invalid credentials, rather than 401.
In simple terms: Use 400 Bad Request for bad login data.
Key Takeaway
Apply correct HTTP status codes.
Themes
software
web development
security
Mood
technical
informative
Type
instructional
technical
When to use this quote
- API design
- backend services
- client validation
Key Concepts
HTTP standards
error handling
authentication
Questions to Reflect On
- When should 401 be used instead?
- How does status choice affect client behavior?
A Different Perspective
Choosing the wrong code can mislead developers.
