If I have a resource that a requesting client doesn’t have access to but I want to notify them about an alternate resource for which they do have access, should I send them a 403 Forbidden with the alternate resource’s URI in the header or content? Or should I just send a 303 See Other redirect to the resource to which they have access?
If I have a resource that a requesting client doesn’t have access to but
Share
There is no HTTP code for ‘forbidden but have a look at this’.
You can, however, customize your 403 error page so that a link to the alternative content is present. If you have multiple alternative links you might find this solution better.
If notifying the user that access is denied is not that important you might want to use a 302 (temporary redirect) instead or, if the user will never have access to the forbidden content, a 301 (permanent redirect).