HTTP 403 Forbidden

When is 403 used?

• Insufficient permissions for the resource
• IP-based access restrictions
• Role-based access control denial

How to handle a 403 response

Inspect the request — URL, method, headers, credentials, and body. Retrying the same request unchanged will usually fail again; 429 is the exception, where you should wait for the Retry-After period.

Check the status code a URL returns from the command line:

curl -s -o /dev/null -w "%{http_code}\n" https://example.com

How to return 403 from your server

Node.js (Express)

res.status(403).json({ message: 'Forbidden' });

Python (Flask)

return {"message": "Forbidden"}, 403

Go (net/http)

w.WriteHeader(403)