HTTP Status Codes Error 403: Forbidden

Identify: does your log match?

HTTP/1.1 403 Forbidden
Content-Type: application/json

{"error":"forbidden","message":"Missing scope: repo:write"}

1. High

   Missing role or OAuth scope

   The token is valid but was issued without the scope (e.g. repo:write) or the user lacks the role the endpoint requires.

2. Medium

   WAF, CDN or IP allowlist block

   Cloudflare, AWS WAF or nginx allow/deny rules reject the client IP or user agent before the app runs.

3. Medium

   CSRF or origin check failed

   Frameworks return 403 when the CSRF token or Origin header does not match for state-changing requests.

Fix

app.delete('/projects/:id', async (req, res) => {
  if (!req.user || req.user.role !== 'admin') return res.sendStatus(401);
});

app.delete('/projects/:id', async (req, res) => {
  if (!req.user) return res.status(401).set('WWW-Authenticate', 'Bearer').end();
  if (req.user.role !== 'admin') {
    return res.status(403).json({ error: 'forbidden', required: 'admin' });
  }
  // ...delete
});

Verify: reproduce it on purpose

$ curl -i https://httpbin.org/status/403

Prevent

• Include the missing permission in the 403 body.
• Return 404 instead of 403 when existence itself is secret.
• Log the policy decision with user id and resource.