Forbidden
The client does not have access rights to the content.
What it means
The HTTP 403 Forbidden client error status response code indicates that the server understood the request but refuses to authorize it.
Unlike 401 Unauthorized, the client's identity is known to the server. Even if they are logged in, they simply do not have permission to access the requested resource.
How it works
- 1The client sends a request with valid authentication.
- 2The server identifies the user, but sees they lack the required Role or Permission (e.g., a standard user trying to access the admin panel).
- 3The server returns 403.
Why you're seeing this
- • Insufficient user permissions.
- • IP address blocked by WAF.
- • Directory browsing is disabled on the web server.
How to fix it
- • Ensure the authenticated user has the correct roles/scopes before making the request.
Framework Implementations
Express.js
app.delete('/post', (req, res) => {
if (req.user.role !== 'admin') {
return res.status(403).send('Forbidden');
}
});Real-Life Scenarios
Use this for Role-Based Access Control (RBAC) when a user tries to perform an action they are not authorized for, or when IP-banning a malicious client.
Admin Dashboard
A normal user guesses the URL /admin and visits it. They are logged in, so they don't get a 401, but they aren't an admin, so they get a 403.
HTTP Transaction
1. Client Request
DELETE /api/users/123 HTTP/1.1 Authorization: Bearer normal-user-token
2. Server Response
HTTP/1.1 403 Forbidden
Content-Type: application/json
{"error": "You do not have permission to delete users"}SEO Implications
Googlebot cannot index 403 pages. Ensure robots.txt or other firewall rules aren't accidentally blocking crawlers.