403 Forbidden

403 Forbidden means the server understood the request and, in most cases, knows exactly who the client is, but refuses to authorize the requested action on this resource. RFC 9110 explicitly distinguishes it from 401: a 403 does not invite the client to re-authenticate, because repeating the request with different credentials would not help, access has been actively denied. Servers may optionally hide the fact that a resource exists by returning 404 instead of 403, but 403 is preferred when confirming existence poses no security risk.

The most common cause is straightforward permissions: role-based access control denies a user's role from performing an action, an object-level ownership check fails, or an IP address falls outside an allowlist. On the filesystem side, misconfigured directory or file permissions, a web server process lacking read access to a static file, or SELinux and AppArmor policies blocking access, produce 403s that have nothing to do with application-level logic at all. These are diagnosed differently: one is a data or policy problem in the app, the other is an operating-system permissions problem on the host.

A large share of confusing 403s are actually CORS failures misread as 403. When a cross-origin request's preflight fails or the response is missing Access-Control-Allow-Origin, browsers block the response from reaching JavaScript and report a generic network or CORS error in the console, which developers sometimes describe as "getting a 403" even though the server may have returned 200 and the browser, not the server, did the blocking. The real fix in that case is CORS header configuration, not permissions, and checking the actual response in the Network tab clarifies which situation you're in.

WAFs and CDN edge security, such as Cloudflare, AWS WAF, and Akamai, generate a large volume of 403s independent of application logic: bot-detection heuristics, missing or suspicious User-Agent headers, geographic blocking, or rate-based rules can all reject a legitimate request before it reaches the origin server. Separately, static file servers with directory listing disabled return 403 for a directory URL with no index file present, rather than showing its contents, a deliberate security default, not a bug, that trips up developers expecting an automatic file listing during local testing.