unauthenticated
What happened
Section titled “What happened”Your session has ended or you are not signed in. Please sign in and try again.
Technical background
Section titled “Technical background”UnauthenticatedError (HTTP 401) fires when a caller without a signed-in
principal reaches a handler that needs one. With anonymousAccess enabled
such a caller is the synthesised anonymous user; without it the request has
no valid token at all.
The status is 401 rather than 403 on purpose: browsers drop an expired auth
cookie, so this is how a lapsed session reaches the server. Clients should
send the user to the sign-in screen instead of showing a permission error.
A signed-in caller without the right role gets
access_denied.