Checkcraft403 Forbidden: what it means and how to fix it in an API
A 403 means the server understood the request but refuses to fulfil it for you. Repeating it with the same credentials will not help: you need other permissions or another address.
What a 403 means
The server knows who you are, or does not need authentication, but access to this resource or action is closed. Unlike a 401, logging in again usually does not help. Some services answer 404 instead of 403 so as not to reveal that the resource exists.
Causes in an API
The token lacks the required role or scope. The user is accessing someone else’s object, such as another customer’s order, and the server correctly refuses. The IP address or country is not on the allow list, or a WAF blocked the request. A browser request lacks the CSRF token, and many frameworks answer that with 403. The API key was issued without access to this method.
403 Forbidden from nginx
If you see the nginx page with “403 Forbidden”, the request never reached the application. Causes: the nginx process cannot read the files, the directory has no index file and listing is off, or the configuration denies this address. For a site visitor this often means an IP block: the site is closed to some countries or to VPN addresses.
How to test access rights
Access checks are among the most important negative tests. User A must not read or change user B’s objects, and a regular user must not call admin methods. The expected answer is 403 or 404, and you need to confirm the data did not change. In Checkcraft these are separate requests with tokens of different roles and rules on the status code.
Repeat this on your own API
Checkcraft is a desktop app that saves API response checks without code and shows what did not match. Start with a sample, then use your own sanitized data. Free runs on Windows and Linux with no time limit.
Download FreeDownload and first runNo sign-up or email needed, the archive is ready in a couple of minutes. See the edition limits.
References
Start with the linked example and compare its result with your own test requirement.