This repository was archived by the owner on Apr 26, 2024. It is now read-only.
This repository was archived by the owner on Apr 26, 2024. It is now read-only.
Incorrect HTTP Status returned on unknown/invalid access token #2602
Description
As per latest stable and unstable spec, 401 must be returned but 403 is returned instead.
This leads to further spec breakage down the line for endpoints that are supposed to return 403 for another error, like (not complete list):
/_matrix/client/r0/rooms/{roomId}/state/{eventType}/{stateKey}/_matrix/client/r0/rooms/{roomId}/state/{eventType}/_matrix/client/r0/rooms/{roomId}/state/_matrix/client/r0/rooms/{roomId}/members/_matrix/client/r0/rooms/{roomId}/joined_members/_matrix/client/r0/rooms/{roomId}/messages/_matrix/client/r0/rooms/{roomId}/invite- etc.
On some of those endpoints, the client would be expected to behave differently, depending if the token is invalid or if authorization to perform the call was lacking (invalidate session & re-login VS give up specific action).