Protected resources should be mapped to which handler?

Protected resources should be mapped to which handler?

• A. HttpForbiddenHandler
• B. HttpNotFoundHandler
• C. HttpAllowedHandler
• D. HttpRedirectHandler

Answer: (A)

When a client attempts to access a resource that is protected, the server should clearly indicate that access is not allowed, even though the resource exists. This is communicated with a 403 Forbidden response. The handler that maps protected resources to this behavior is the one that generates that forbidden response, HttpForbiddenHandler. HttpForbiddenHandler is appropriate because it signals that authentication was provided but the client does not have the necessary permissions, or the request is otherwise disallowed. NotFound would mislead by saying the resource doesn’t exist, which isn’t true for a protected resource. Redirect would push the client elsewhere, which is a different pattern and not a direct denial. HttpAllowedHandler would imply access is permitted, contradicting protection.

When a client attempts to access a resource that is protected, the server should clearly indicate that access is not allowed, even though the resource exists. This is communicated with a 403 Forbidden response. The handler that maps protected resources to this behavior is the one that generates that forbidden response, HttpForbiddenHandler.

HttpForbiddenHandler is appropriate because it signals that authentication was provided but the client does not have the necessary permissions, or the request is otherwise disallowed. NotFound would mislead by saying the resource doesn’t exist, which isn’t true for a protected resource. Redirect would push the client elsewhere, which is a different pattern and not a direct denial. HttpAllowedHandler would imply access is permitted, contradicting protection.