This is sent for "failed login" errors [1]. IIRC, I might have changed this value sometime in... 2006? The reason was that links (the browser) was displaying a BASIC login prompt which prevented the HTML login form from working, and the BASIC auth doesn't work unless the URL also contains basicauth=1. The status codes affect the current HTTP request, and the action is to submit (bad) authentication credentials. I don't think using 401 or 403 is correct: - 401: am I required to log in before submitting my credentials? - 403: am I forbidden from submitting my credentials? I checked a few other sites, and they all use 200 when providing wrong passwords. [1] https://github.com/xwiki/xwiki-platform/blob/master/xwiki-platform-core/xwik... On 09/16/2014 03:42 AM, Pascal BASTIEN wrote:
Hello,
There are a tiny "issue" to fix in default xwiki.cfg: #-# HTTP status code to sent when the authentication failed. xwiki.authentication.unauthorized_code=200
I think 401 (OR 403) is more appropriate, isn't it?
wdyt?
Thxs
-- Sergiu Dumitriu http://purl.org/net/sergiu