title: Correct HTTP status code for login form?
body: <p>I am implementing the authentication for an app, and I am using a pluggable system with "authentication methods". This allows me to implement both HTTP Basic as well as HTML-based authentication.</p>
  
  <p>With HTTP Basic/Digest auth the server sends a <code>401 Unauthorized</code> response header. However, according to the <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.2" rel="noreferrer">HTTP/1.1 RFC</a>:</p>
  
  <blockquote>
    <p>The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource.</p>
  </blockquote>
  
  <p>Since I do not know of any "html" WWW-Authenticate header, sending a <code>401</code> with an HTML login form seems inappropriate. Is there any alternative to this? I want to design my app in a RESTful way.</p>
  
  <p>What is the correct HTTP Status code (and headers) for an HTML-based login form? And what is the correct code when the login fails?</p>
  
  <p><strong>Note</strong>: I am not interested in Digest Authentication.</p>