The 403 Forbidden status code indicates that the server understood the request but refuses to authorize it. The client is authenticated or identifiable, but does not have permission to access the requested resource.
403 errors commonly occur due to permission rules, authentication failures, IP restrictions, or server-side access control mechanisms. Unlike 401 Unauthorized, authentication will not fix a 403 response.
// Express.js example returning 403 Forbidden
app.get("/admin", (req, res) => {
res.status(403).send("403 Forbidden: Access denied");
});
When a user without sufficient privileges accesses /admin, the server responds with 403 Forbidden and blocks access.
Select a user role below and try to access the restricted /admin dashboard.
// Logic simulating the interactive tool above
const role = getCurrentUserRole();
if (role === 'admin') {
return { status: 200, message: "Access Granted" };
} else {
return { status: 403, message: "Forbidden: Admins only" };
}