Which HTTP Error Should API Gateway Return for Invalid Login Credentials?
A developer is testing a RESTful application that is deployed by using Amazon API Gateway and AWS Lambda. When the developer tests the user login by using credentials that are not valid, the developer receives an HTTP 405: METHOD_NOT_ALLOWED error. The developer has verified that the test is sending the correct request for the resource. Which HTTP error should the application return in response to the request?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests the ability to distinguish between HTTP status codes for authentication failures (401) versus other errors like method not allowed (405), not found (404), or server issues (5xx).
When a user attempts to log in with invalid credentials via an Amazon API Gateway and AWS Lambda RESTful application, the correct HTTP error to return is 401 Unauthorized. This question tests your understanding of standard HTTP status codes and proper authentication error handling.
Candidates often confuse HTTP 405 (Method Not Allowed) with authentication errors or may mistakenly choose 404 (Not Found) thinking the user does not exist. The 405 error in the scenario is a red herring caused by incorrect method mapping in API Gateway, not the actual authentication response.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Understanding the Scenario
In this question, a developer is testing a RESTful application built with Amazon API Gateway and AWS Lambda. When testing a user login with invalid credentials, the developer receives an HTTP 405: METHOD_NOT_ALLOWED error. However, the developer has confirmed that the request is being sent correctly to the right resource.
Why HTTP 401 is the Correct Answer
The correct HTTP status code for a failed authentication attempt due to invalid credentials is HTTP 401 Unauthorized. According to the HTTP specification (RFC 7235), a 401 response indicates that the request lacks valid authentication credentials for the requested resource. This is the standard and expected behavior for any RESTful API when a user provides incorrect login information.
Why the Other Options Are Incorrect
- HTTP 404 (Not Found): This status code is used when the requested resource does not exist on the server. It is not appropriate for authentication failures. Returning 404 for invalid credentials can also be a security risk, as it may reveal whether a username exists in the system.
- HTTP 503 (Service Unavailable): This indicates that the server is temporarily unable to handle the request, typically due to maintenance or overload. It has nothing to do with authentication logic.
- HTTP 505 (HTTP Version Not Supported): This error means the server does not support the HTTP protocol version used in the request. It is extremely rare and unrelated to login failures.
The Role of HTTP 405 in This Question
The HTTP 405: METHOD_NOT_ALLOWED error mentioned in the scenario is a red herring. It typically occurs in API Gateway when the HTTP method (e.g., POST) used in the request is not configured for the specific resource path. Since the developer verified the request is correct, this error is likely a misconfiguration or distraction. The question is asking what the application should return for invalid credentials, which is unambiguously HTTP 401.
Community Consensus
The community overwhelmingly agrees that A (HTTP 401) is the correct answer, with 100% of votes supporting this choice. Candidates note that 401 is the standard response for authentication failures in RESTful APIs.
Official Reference
Exam Strategy
When you see an HTTP status code question on the exam, focus on the standard definitions of each code. Authentication failures always map to 401, while 403 is for authorization failures. Do not be distracted by error codes mentioned in the scenario if they do not match the actual question being asked.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →