domains / families / security / 401-403-bypass

401-403-bypass

separate

Use when protected HTTP routes return 401 or 403.

When to use

• A known route returns `401 Unauthorized` or `403 Forbidden`.
• A reverse proxy, WAF, API gateway, or CDN sits in front of the application.
• Frontend and backend normalize paths, methods, or headers differently.
• IIS, Tomcat, Spring, Apache, Nginx, or WebDAV routing is visible.
• Equivalent requests return different status, headers, or body, hinting at a routing differential.

When not to use

• tasks not involving 401 or 403 status codes

Skill page

Source