Should I return a http 401 status code on an html based login form? The page is a dedicated login form, and does not have any other meaningful content, just site framework. The URL however, can be for a page that does have meaningful content, but requires login. Note that this setup only returns the status code 401, and doesn't prompt the user for basic authentication.
Looking at the standards it seems that 401 is an inappropriate status code for html based login forms. However, I have never experienced or heard of any ill consequences of doing so.
When sending 401, "The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource."
requirement mentioned here:
https://www.rfc-editor.org/rfc/rfc2616#section-10.4.2
detailed here:
https://www.rfc-editor.org/rfc/rfc2617#section-3.2.1
I know there are ways that I can work around search engines in convincing them to index, or not, pages based on the presence of a login form, but I'd prefer to use http status codes, specifically 401 since it's definition seems like a perfect match if not for the WWW-Authenticate header requirement.
Is there any reason why I shouldn't use 401 in this case? Semantically is there any difference between not being Authorised at the http level versus being Authorised at the application level? Obviously you can have both, but isn't authentication at the http level just for ease of not implementing it at the application level?