{"action":"opened","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/134","labels_url":"https://api.github.com/repos/aspnet/Security/issues/134/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/134/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/134/events","html_url":"https://github.com/aspnet/Security/issues/134","id":55554494,"number":134,"title":"[Exploratory Testing] No way of distinguishing 401 vs 403 for apis.","user":{"login":"harshgMSFT","id":6729943,"avatar_url":"https://avatars.githubusercontent.com/u/6729943?v=3","gravatar_id":"","url":"https://api.github.com/users/harshgMSFT","html_url":"https://github.com/harshgMSFT","followers_url":"https://api.github.com/users/harshgMSFT/followers","following_url":"https://api.github.com/users/harshgMSFT/following{/other_user}","gists_url":"https://api.github.com/users/harshgMSFT/gists{/gist_id}","starred_url":"https://api.github.com/users/harshgMSFT/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/harshgMSFT/subscriptions","organizations_url":"https://api.github.com/users/harshgMSFT/orgs","repos_url":"https://api.github.com/users/harshgMSFT/repos","events_url":"https://api.github.com/users/harshgMSFT/events{/privacy}","received_events_url":"https://api.github.com/users/harshgMSFT/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/aspnet/Security/milestones/4","labels_url":"https://api.github.com/repos/aspnet/Security/milestones/4/labels","id":913789,"number":4,"title":"1.0.0-rc1","description":"","creator":{"login":"Tratcher","id":1821173,"avatar_url":"https://avatars.githubusercontent.com/u/1821173?v=3","gravatar_id":"","url":"https://api.github.com/users/Tratcher","html_url":"https://github.com/Tratcher","followers_url":"https://api.github.com/users/Tratcher/followers","following_url":"https://api.github.com/users/Tratcher/following{/other_user}","gists_url":"https://api.github.com/users/Tratcher/gists{/gist_id}","starred_url":"https://api.github.com/users/Tratcher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tratcher/subscriptions","organizations_url":"https://api.github.com/users/Tratcher/orgs","repos_url":"https://api.github.com/users/Tratcher/repos","events_url":"https://api.github.com/users/Tratcher/events{/privacy}","received_events_url":"https://api.github.com/users/Tratcher/received_events","type":"User","site_admin":false},"open_issues":8,"closed_issues":3,"state":"open","created_at":"2014-12-23T23:47:55Z","updated_at":"2015-01-26T23:41:42Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2015-01-26T23:41:42Z","updated_at":"2015-01-26T23:41:42Z","closed_at":null,"body":"Since we do not have a separate authentication phase, we do authentication and authorization while doing authorization. Since the current overloads only return a bool, there is currently no way of distinguishing between an authentication failure ( 401 ) vs an authorization failure ( 403 ). \r\nAlso read #133."}}