HTTP 403 Forbidden

What is HTTP 403 Forbidden?

The 403 (Forbidden) status code indicates that the server understood the request but refuses to authorize it. Unlike 401, the client's identity is known to the server, but the client does not have the necessary permissions. The server may include an explanation in the response body, but often returns a generic message for security reasons.

Common Use Cases

• Accessing a resource without sufficient permissions
• IP address blacklisting
• Directory listing disabled
• CSRF token validation failure

// Laravel - authorization gate returning 403
if ($request->user()->cannot('view-admin')) {
    abort(403, 'Admin access required.');
}

// Using policies
abort_if($user->cannot('update', $post), 403);