|OT| HTTP header response for invalid form inputs?

[R. Rajesh Jeba Anbiah]

Is it necessary or is there any standard to send HTTP header status
for form inputs ? Say, the user is entering invalid password in login
form and now all the applications I have seen are just displaying error
messages above the form (with HTTP status 200); is it necessary to send
401 status in this case?

--
<?php echo 'Just another PHP saint'; ?>
Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/

[Janwillem Borleffs]

R. Rajesh Jeba Anbiah wrote:

Is it necessary or is there any standard to send HTTP header status
for form inputs ? Say, the user is entering invalid password in login
form and now all the applications I have seen are just displaying
error messages above the form (with HTTP status 200); is it necessary
to send 401 status in this case?

The 401 header is generally only used with REALM authentication. When this
type of authentication isn't used, the HTTP 200 header is more appropriate,
because the page is found and the error is handled on the page itself.

Another reason for using HTTP headers is when the application responses are
interpreted by another application. A quick look at the status then will
give an indication of the success rate, without parsing the response body.
JW

[Toby Inkster]

R. Rajesh Jeba Anbiah wrote:

Is it necessary or is there any standard to send HTTP header status
for form inputs ? Say, the user is entering invalid password in login
form and now all the applications I have seen are just displaying error
messages above the form (with HTTP status 200); is it necessary to send
401 status in this case?

A 401 response should only be used if you're using HTTP authentication.

403 Forbidden might be more appropriate here.

--
Toby A Inkster BSc (Hons) ARCS
Contact Me ~ http://tobyinkster.co.uk/contact

[R. Rajesh Jeba Anbiah]

Toby Inkster wrote:

R. Rajesh Jeba Anbiah wrote:

Is it necessary or is there any standard to send HTTP header status
for form inputs ? Say, the user is entering invalid password in login
form and now all the applications I have seen are just displaying error
messages above the form (with HTTP status 200); is it necessary to send
401 status in this case?

A 401 response should only be used if you're using HTTP authentication.

403 Forbidden might be more appropriate here.

Thanks for your inputs. I really appreciate it. Thanks again.

--
<?php echo 'Just another PHP saint'; ?>
Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/

[R. Rajesh Jeba Anbiah]

Janwillem Borleffs wrote:

R. Rajesh Jeba Anbiah wrote:

Is it necessary or is there any standard to send HTTP header status
for form inputs ? Say, the user is entering invalid password in login
form and now all the applications I have seen are just displaying
error messages above the form (with HTTP status 200); is it necessary
to send 401 status in this case?

The 401 header is generally only used with REALM authentication. When this
type of authentication isn't used, the HTTP 200 header is more appropriate,
because the page is found and the error is handled on the page itself.

Another reason for using HTTP headers is when the application responses are
interpreted by another application. A quick look at the status then will
give an indication of the success rate, without parsing the response body.

Thanks for your insights. I was wondering if HTTP status code is
necessary in form processing. Thanks again.

--
<?php echo 'Just another PHP saint'; ?>
Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/

[Umberto Salsi]

"R. Rajesh Jeba Anbiah" <ng**********@rediffmail.com> wrote:

Is it necessary or is there any standard to send HTTP header status
for form inputs ? Say, the user is entering invalid password in login
form and now all the applications I have seen are just displaying error
messages above the form (with HTTP status 200); is it necessary to send
401 status in this case?

If you are using the HTTP basic or digest authentication (RFC 2616,
2617) 401 is the correct status code if the authentication failed.

If you are using an application based authentication, you should always
return a 200 status code and a page with a human readable description of
the problem ("Invalid login, please retry. Forgot your password? Click
here!" etc. etc.).

Regards,
___
/_|_\ Umberto Salsi
\/_\/ www.icosaedro.it

[R. Rajesh Jeba Anbiah]

Umberto Salsi wrote:

"R. Rajesh Jeba Anbiah" <ng**********@rediffmail.com> wrote: <snip> If you are using an application based authentication, you should always
return a 200 status code and a page with a human readable description of
the problem

<snip>

Thanks a lot for the explanation; this is what I was confusing with.
Thanks again.

--
<?php echo 'Just another PHP saint'; ?>
Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/