Editing Web server (section)

==== URL authorization ====
A web server program may be able to verify whether the requested URL path:<ref name="rfc7235-1">{{cite IETF |rfc=7235 |sectionname=Introduction|section=1|title=RFC 7235, HTTP/1.1: Authentication|page=3}}</ref>
* can be freely accessed by everybody;
* requires a user authentication (request of user credentials, e.g. such as [[user name]] and [[password]]);
* access is forbidden to some or all kind of users.

If the authorization / access rights feature has been implemented and enabled and access to web resource is not granted, then, depending on the required access rights, a web server program:
* can deny access by sending a specific error message (e.g. access [[List of HTTP status codes#403|forbidden]]);
* may deny access by sending a specific error message (e.g. access [[List of HTTP status codes#401|unauthorized]]) that usually forces the client browser to ask human user to provide required user credentials; if authentication credentials are provided then web server program verifies and accepts or rejects them.