The HTTP 1.1 spec says:
10.4.4 403 Forbidden
The server understood the request, but is refusing to fulfill it.
Authorization will not help and the request SHOULD NOT be repeated. [...]
Does this mean only "basic authorization", as in WWW-Authenticate: Basic? Should a 403 ever be issued for resources where some other user could potentially access the denied resource through means other than basic HTTP authentication (for example through his session cookie, OpenID, etc.)?
I'm asking this since HTTP 401 says that...
the response MUST include a
WWW-Authenticate headerfield
...and I'm not sure if I should actually add a header like WWW-Authenticate: Custom.
Many people seem to use 403, even in cases where a simple cookie could have made the resource available. Are they all wrong?