3

I am writing some code to respond in a useful way to an expired login in a web app. It's form-based login. It's the HTTP status code I'd like to decide upon.

I tried 401, but this causes an authentication dialog to pop up in the browser. I spotted some threads mentioning error "440 Login Expired" used in some Microsoft apps, but I can't find anything about that in the W3C docs, nor any other code which seems suitable for an expired form login.

So would it be ok to respond with 440 - is this a kind of ad-hoc standard? Or is there a better code that others use? Or is it a case of just make one up for the app?

Many thanks!

ingredient_15939
  • 3,022
  • 7
  • 35
  • 55

1 Answers1

0

This might be a close relative question to Correct HTTP status code for login form?. Whether your login has expired or whether you have never had one should make no difference.

The answers given on that other question where:

  1. 400 - accepted answer and I strongly disagree with it.
  2. 401 - with a WWW-Authenticate header which may contain anything, it doesn't matter, browsers should (!?) ignore it if you do not put a basic or digest authentication challenge here.

But what I am missing is the real distinction as to how the login form is being delivered. It can be either * injected as a response to the current request (that is what the 401 answer was suggesting to do) * or delivered with a redirect, e.g. 302 to a login page, which, once completed dialogue, will redirect back to the original request.

I have for 10 years run my application with 302 redirect to login page. But I do not like it any more. I want to return 401 so that my scripted agents, REST, etc. will do their stuff properly.

So, what needs to be done to really settle this question is to check how browsers behave when getting a 401 response with WWW-Authentication header that does not have a digest or basic challenge. If they always bring up their dialogue then it's a no-go no matter what we think would be the right and proper way of doing things.

I also need to send 401 with a Location: header and see if the browsers would redirect.

Gunther Schadow
  • 1,490
  • 13
  • 22