What exactly does the Access-Control-Allow-Credentials header do?

I’m trying to understand how to use CORS and am confused about what the Access-Control-Allow-Credentials header does. The documentation says Indicates whether or not the response to the request can be exposed when the credentials flag is true. But I don’t understand what the response being “exposed” means. Can anyone explain what this header being … Read more

403 Forbidden vs 401 Unauthorized HTTP responses

For a web page that exists, but for which a user does not have sufficient privileges (they are not logged in or do not belong to the proper user group), what is the proper HTTP response to serve? 401 Unauthorized? 403 Forbidden? Something else? What I’ve read on each so far isn’t very clear on … Read more