CODEWITHSUNDEEP
http
wcarhart
wcarhart

Reputation: 2773

What's the proper HTTP error code to use when request is missing origin header?

I am designing an API and a requirement to access some endpoints is the Origin header must be set in the request. I am rejecting requests that either (a) are missing the header altogether or (b) are sending requests from an origin that is not in a specified allowlist.

When I reject requests that do not meet these criteria, what is the correct HTTP error code to use? I initially thought 401 or 403, but there's not any true authentication/authorization issue in these cases. 400 feels too generic. Is there a code more specific to this scenario?

Upvotes: 1

Views: 564

Answers (1)

rhinosforhire
rhinosforhire

Reputation: 1345

The 400 may feel "too generic" but I think it's for this exact scenario where you are rejecting incomplete or otherwise bad requests.

Upvotes: 1

Related Questions