Controllers not allowed returning bad request instead of 401 or 403

[Brend-Smits]

If a person is not allowed to perform a certain action because they don't have permission. It should not be returning Bad Request. It should return a 401 Unauthorized instead.

The coding guidelines should also be updated to reflect this change.

[StijnGroenen]

It should return 401 Unauthorized if the user is not authenticated / signed in.
If the user is authenticated / signed in but it does not have the right permissions to perform an action it should return 403 Forbidden.

[wotwot563]

its debatable as seen in the rfc https://tools.ietf.org/html/rfc7235#section-3.1 its both possible, but my preference also goes out to 403

[Brend-Smits]

Forbidden would be a good option if it allowed to ship a body. We can not describe to the user why they were forbidden.
With Unauthorized we can tell the user why the request was not allowed.