fix: give correct unauthorized response on OpenID Connect Auth

fastapi/security/open_id_connect_url.py

@@ -4,7 +4,7 @@
 from fastapi.security.base import SecurityBase
 from starlette.exceptions import HTTPException
 from starlette.requests import Request
-from starlette.status import HTTP_403_FORBIDDEN
+from starlette.status import HTTP_401_UNAUTHORIZED
 from typing_extensions import Annotated, Doc  # type: ignore [attr-defined]
 
 
@@ -77,7 +77,7 @@ async def __call__(self, request: Request) -> Optional[str]:
         if not authorization:
             if self.auto_error:
                 raise HTTPException(
-                    status_code=HTTP_403_FORBIDDEN, detail="Not authenticated"
+                    status_code=HTTP_401_UNAUTHORIZED, detail="Unauthorized"
                 )
             else:
                 return None

tests/test_security_openid_connect.py

@@ -39,8 +39,8 @@ def test_security_oauth2_password_other_header():
 
 def test_security_oauth2_password_bearer_no_header():
     response = client.get("/users/me")
-    assert response.status_code == 403, response.text
-    assert response.json() == {"detail": "Not authenticated"}
+    assert response.status_code == 401, response.text
+    assert response.json() == {"detail": "Unauthorized"}
 
 
 def test_openapi_schema():

tests/test_security_openid_connect_description.py

@@ -41,8 +41,8 @@ def test_security_oauth2_password_other_header():
 
 def test_security_oauth2_password_bearer_no_header():
     response = client.get("/users/me")
-    assert response.status_code == 403, response.text
-    assert response.json() == {"detail": "Not authenticated"}
+    assert response.status_code == 401, response.text
+    assert response.json() == {"detail": "Unauthorized"}
 
 
 def test_openapi_schema():