title: Returning HTTP 401 status for AJAX responses without WWW-Authenticate
body: <p>Is it OK to return an <strong>HTTP 401</strong> status for a response to an AJAX call if you wish to convey that the user is not logged in, even though the login mechanism is form-based and not HTTP based (Basic, Digest, etc.)?</p>
  
  <p>The answer here suggests that 401 should be used:
  <a href="https://stackoverflow.com/a/6937030/2891365">https://stackoverflow.com/a/6937030/2891365</a></p>
  
  <p>And this post shows an actual example of someone using 401 for an AJAX response: <a href="http://www.bennadel.com/blog/2228-some-thoughts-on-handling-401-unauthorized-errors-with-jquery.htm" rel="noreferrer">http://www.bennadel.com/blog/2228-some-thoughts-on-handling-401-unauthorized-errors-with-jquery.htm</a></p>
  
  <p>However, <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html" rel="noreferrer">RFC 2616 for HTTP/1.1</a> clearly states that a special header is necessary, <em>implying</em> that it can only be used for HTTP authentication.</p>
  
  <blockquote>
    <p><strong>10.4.2 401 Unauthorized</strong></p>
    
    <p>The request requires user authentication. The response <strong>MUST</strong> include a <em><code>WWW-Authenticate</code></em> header field (section 14.47) containing a challenge applicable to the requested resource.</p>
  </blockquote>
  
  <p>I guess I can probably send a bogus header like <code>WWW-Authenticate: WebForm</code> and still conform to W3C specs but it feels like it's violating the spirit of the <code>WWW-Authenticate</code> header.</p>
  
  <p>In the end, I cannot seem to find an authoritative source that explicitly states whether HTTP 401 is allowed for AJAX responses. Is there an authoritative source on this that I missed?</p>