<div>For some reason that I don't remember now, we discussed about 401 x 403 when the REST authentication API was sent, people decided for 401.
</div><div><br></div><div>I'm not picky on it because this is easy to change and only related to our TODO. We discussed about authentication methods like amazon s3 in the past <a href="https://github.com/abstractj/aerogear-security/blob/deltaspike/README.md">https://github.com/abstractj/aerogear-security/blob/deltaspike/README.md</a></div><div><br></div><div>We have tons of changes to do now, my only concern at the current TODO app was to get it done to j1.</div>
<div><div><br></div><div><br></div><div><div>-- </div><div>"The measure of a man is what he does with power" - Plato</div><div>-</div><div>@abstractj</div><div>-</div><div>Volenti Nihil Difficile</div></div></div>
<p style="color: #A0A0A8;">On Tuesday, October 2, 2012 at 8:08 AM, Matthias Wessendorf wrote:</p>
<blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;">
<span><div><div><div>Hi,</div><div><br></div><div>I think they return 403 since they (like us) lack the WWW-Authenticate header.</div><div><br></div><div>Which is required on 401:</div><div><a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.47">http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.47</a></div><div><br></div><div>-M</div><div><br></div><div>On Tue, Oct 2, 2012 at 12:56 PM, Matthias Wessendorf <<a href="mailto:matzew@apache.org">matzew@apache.org</a>> wrote:</div><blockquote type="cite"><div><div>Hi,</div><div><br></div><div>I noticed that with Amazon's S3 (for instance) they return 403 when</div><div>you are not authorized. Not really sure, but forbidden (403) is</div><div>perhaps fine when accessing a protected REST endpoint (versus 401) ?</div><div><br></div><div>Thoughts?</div><div><br></div><div>-Matthias</div><div><br></div><div>--</div><div>Matthias Wessendorf</div><div><br></div><div>blog: <a href="http://matthiaswessendorf.wordpress.com">http://matthiaswessendorf.wordpress.com</a>/</div><div>sessions: <a href="http://www.slideshare.net/mwessendorf">http://www.slideshare.net/mwessendorf</a></div><div>twitter: <a href="http://twitter.com/mwessendorf">http://twitter.com/mwessendorf</a></div></div></blockquote><div><br></div><div><br></div><div><br></div><div>-- </div><div>Matthias Wessendorf</div><div><br></div><div>blog: <a href="http://matthiaswessendorf.wordpress.com">http://matthiaswessendorf.wordpress.com</a>/</div><div>sessions: <a href="http://www.slideshare.net/mwessendorf">http://www.slideshare.net/mwessendorf</a></div><div>twitter: <a href="http://twitter.com/mwessendorf">http://twitter.com/mwessendorf</a></div><div>_______________________________________________</div><div>aerogear-dev mailing list</div><div><a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a></div><div><a href="https://lists.jboss.org/mailman/listinfo/aerogear-dev">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a></div></div></div></span>
</blockquote>
<div>
<br>
</div>