4xx Client errors

HTTP 401 Unauthorized

HTTP 401 Unauthorized means the request has no valid authentication: the client must log in or send a valid token.

What 401 Unauthorized means

Despite the name, 401 is about authentication (who you are), not permission. Send it when the token is missing, expired or has a bad signature. A client usually reacts by refreshing the token or redirecting to login.

Common causes

  • No Authorization header or session cookie.
  • An expired JWT (check the exp claim) or one signed with another secret.
  • Clock skew between servers making a fresh token look expired.

How to fix or use it

Return 401 for missing or invalid credentials and 403 for authenticated users without permission. In Angular, an HTTP interceptor can catch 401, refresh the token once and retry.

Express (Node.js) example

function requireAuth(req, res, next) {
  const token = req.headers.authorization?.replace(/^Bearer /, '');
  try {
    req.user = jwt.verify(token, process.env.JWT_SECRET);
    next();
  } catch {
    res.status(401).json({ message: 'Not authenticated' });
  }
}

SEO impact

Crawlers do not log in, so 401 pages are never indexed. Keep public content outside authenticated routes.

Other 4xx Client errors codes