Can we add error message body on HTTP 401 response code, I am trying to get it but it's blank though it's set from server

Question

Can we add message body for the error on HTTP 401 response. On 500 sereies I was getting the error response body but on 401 I am not been able to get the body though the body is set in the server?

Please suggest.

Answer 1

An HTTP 401 means Unauthorized. From RFC 2616, it can be read:

The request requires user authentication. The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource.

The client MAY repeat the request with a suitable Authorization header field (section 14.8). If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials.

If the 401 response contains the same challenge as the prior response, and the user agent has already attempted authentication at least once, then the user SHOULD be presented the entity that was given in the response, since that entity might include relevant diagnostic information. HTTP access authentication is explained in "HTTP Authentication: Basic and Digest Access Authentication" [43].

While this is a bit generic, it showns no restriction on what the body of the request can/cannot contain. Check on your tool on what/how to reply for non HTTP 200 (OK).