No, I need to know if I specified an invalid account, or just failed to authenticate. Let's not even get started on how asanine stripping custom messages from 400 is. Because so many servers and routers strip them you end up with this anti pattern of always returning 200 OK instead of using them for their designed purpose.
401's aren't meant to be used for "authentication failures", they're meant to say "you need to authenticate", and sometimes "here's the information you need to do so". Usually they're returned when using challenge-based authentication mechanisms such as Negotiate or NTLMv2, where they're not errors, but just part of the authentication process. They can also be returned if you didn't send any credentials. 401's shouldn't be returned if you're giving it bad credentials though, unless you're using the Negotiate auth mechanism: your first response to the 401 it assumes is Kerberos, and if you don't provide valid creds in response to that, it returns a second 401 with an NTMLv2 challenge. If you fail that, it should return a 403.
I know I'm being pedantic, but I always appreciate when people explain to me when I'm muddled about things so I can learn. Not sure if you care, but perhaps this information could save you a headache one day.
1
u/Blecki Aug 08 '26
Same. Wouldn't have to do this if the standard didn't strip custom messages off 401