You Happen to be on level re: data leakage and this should be a vital consideration for anybody rolling their particular authentication/authorization scheme. +one for mentioning OWASP. The server understood the ask for, but is refusing to meet it. Authorization will not aid plus the request Really should not be http://pigpgs.com