The client is known but not allowed to do this.
When to use it
Logged in, but lacking permission.
Common causes and fixes
On web servers, 403 usually means the file system or config denies access. nginx returns it when its worker user can’t read a file or traverse a parent folder (it needs x on every directory in the path), when a folder has no index file and autoindex is off, or for a deny rule. The error log says which: “permission denied” or “directory index is forbidden”.
Other sources: a WAF or Cloudflare blocking the request (look for a Ray ID on the error page), bot rules rejecting curl’s user agent, Django’s CSRF check, an expired S3 presigned URL, or S3 answering 403 instead of 404 for missing objects when the caller lacks s3:ListBucket. In APIs, 403 means valid credentials without permission: check roles, OAuth scopes and resource ownership.
Client error (4xx)
4xx codes are client errors: the request itself is wrong, unauthorised or points at something that isn’t there. Retrying the same request won’t help.
What it looks like
HTTP/1.1 403 ForbiddenHow to send it
| Node.js / Express | res.status(403).end() |
|---|---|
| Python / Flask | return '', 403 |
| nginx | return 403; |
How to check it
curl -s -o /dev/null -w "%{http_code}\n" https://example.com/