Authentication

Why can sign-in succeed while an action is denied?

Sign-in establishes identity; it does not grant every permission. In this hypothetical example, Account A signs in successfully and requests Account B's private record. A denial is the correct result. Granting every signed-in user access would turn a confusing screen into a security defect.

1. 1Check that the failing request carries the current session rather than an expired one.
2. 2Check which account owns the requested resource and which permission the action needs.
3. 3Repeat with the owning test account, then with a non-owner and while signed out.

What should an expired session look like?

An app should not announce that a protected save succeeded when the server rejected it. It should preserve recoverable input where appropriate, show that sign-in is needed and let the user retry after identity is restored. A hidden navigation item is not an access control: the server still needs to reject direct requests.

Start with Authentication versus authorization below. For a concrete 401, follow the linked troubleshooting guide and inspect credentials before changing permissions. Never share a session token when asking for help.