What status code should I use when session token is invalid?

Question

When creating a web service (RESTful), what status code should I use when session token is invalid? Currently the one in my company sends me a 404, not found, but I think this is not correct, because the resource exists. Maybe I should use 401 Unauthorized. What do you think? What status code do you recommend me to use in this scenario? Thanks.

Answer 1

401 Unauthorized.

Your existing session token doesn't authorize you any more, so you are unauthorized.

Don't forget that a session token is just a short-cut to avoid having to provide credentials for every request.

Sending 404 is incorrect because, as you observe, the resource does exist. You just don't currently have authorization to see it.

NB Don't use 403 Forbidden; the HTTP specification defines it as follows: "The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated." That doesn't apply in this case as authorization WILL help.

Answer 2

Looking through the HttpStatusCode enum, I think Unauthorized is probably the closest to what you're looking for.

Take a look at the list there, and read the descriptions for each one.