I'm implementing a very simple authentication scheme. Username:Password are sent (via header of an HTTPS POST request) to a PHP file on an Apache server that checks whether that combination is in a MySQL database or not and whether it has expired.
As I'm fairly new to web engineering (if you can call what I do that), I'm a little unsure how to execute the response.
Should I return true or false (or something like this that shows whether authentication worked or not) in the body of the HTTPS response - or in the header (both of which would be HTTP status code 200, I guess)? Or would it be best practice to return with status code such as 200 for successful auth and something like 401 Unauthorized in case the user:pass combination was not found/is expired?