title: HTTP 401 Unauthorized or 403 Forbidden for a "disabled" user?
body: <p>An authentication service allows user accounts be disabled (a sort of soft-delete).</p>
  <p>If the server then receives an authentication request for a disabled user that would otherwise be valid, should the server return 401 or 403? With either status code, I would return a message indicating that the account had been disabled.</p>
  <p>For quick reference, relevant quotes from <a href="https://www.rfc-editor.org/rfc/rfc2616#page-66" rel="nofollow noreferrer">HTTP/1.1 spec</a> (emphasis mine):</p>
  <p><strong>401 Unauthorized</strong></p>
  <blockquote>
  <p>The request requires user authentication. The response MUST include a
  WWW-Authenticate header field (section 14.47) containing a challenge
  applicable to the requested resource. <strong>The client MAY repeat the
  request</strong> with a suitable Authorization header field (section 14.8). <strong>If
  the request already included Authorization credentials</strong>, then the 401
  response indicates that <strong>authorization has been refused for those
  credentials</strong>. If the 401 response contains the same challenge as the
  prior response, and the user agent has already attempted
  authentication at least once, then the <strong>user SHOULD be presented the
  entity that was given in the response</strong>, since that entity might
  include relevant diagnostic information. HTTP access authentication
  is explained in &quot;HTTP Authentication: Basic and Digest Access
  Authentication&quot; [43].</p>
  </blockquote>
  <p><strong>403 Forbidden</strong></p>
  <blockquote>
  <p>The server understood the request, but is refusing to fulfill it.
  <strong>Authorization will not help</strong> and the <strong>request SHOULD NOT be repeated</strong>.
  If the request method was not HEAD and the server wishes to make
  public why the request has not been fulfilled, it <strong>SHOULD describe the
  reason for the refusal in the entity</strong>.  If the server does not wish to
  make this information available to the client, the status code 404
  (Not Found) can be used instead.</p>
  </blockquote>