What is the problem associated with error 401?

Error 401 Unauthorized indicates that the client request was not authorized. This means that the client does not have the necessary credentials (such as login and password, access token) to access the requested resource.

Main issues related to the 401 error:

1. Incorrect or missing credentials:
   • User entered wrong login/password.
   • Request was sent without necessary credentials (e.g., without Authorization header).
   • Access token has expired or is invalid.
2. Server-side error:
   • Server is misconfigured for authentication.
   • Authentication service is unavailable or malfunctioning.
   • Error in token signature verification.
3. Infrastructure issues:
   • Proxy server or firewall blocks authentication data transmission.
   • DNS or network issues preventing proper interaction with the authentication service.
4. Incorrect client-side logic:
   • Client application does not send or sends incorrect authentication data.
   • Incorrect handling of 401 response (e.g., no redirect to login page).

To diagnose and resolve the issue, QA engineer should:

• Check server and client logs.
• Use browser developer tools (Network tab) to analyze request and response (especially Authorization and WWW-Authenticate headers).
• Verify the correctness of credentials.
• Review API documentation for authentication requirements.
• Check the authentication service if it is separate.

Example of Authorization header in a request:

// GET /api/v1/resource HTTP/1.1
// Host: example.com
// Authorization: Bearer your_access_token
// User-Agent: Your-Client/1.0
// Accept: application/json

Example of WWW-Authenticate header in a 401 response:

// HTTP/1.1 401 Unauthorized
// Content-Type: text/plain
// WWW-Authenticate: Bearer realm="Access to the protected area"
// Content-Length: 21
// Connection: keep-alive
//
// Unauthorized access.