# WEBrick sending wrong http status code?

**URL:** <https://discuss.rubyonrails.org/t/webrick-sending-wrong-http-status-code/58852>\
**Category:** rubyonrails-talk\
**Created:** [May 8, 2011, 3:51am UTC](https://discuss.rubyonrails.org/t/webrick-sending-wrong-http-status-code/58852 "2011-05-08T03:51:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_Hanna](https://avatars.discourse-cdn.com/v4/letter/m/54ee81/32.png) [@Michael\_Hanna](https://discuss.rubyonrails.org/u/Michael_Hanna)\
**Post date:** [May 8, 2011, 3:51am UTC](https://discuss.rubyonrails.org/t/webrick-sending-wrong-http-status-code/58852/1 "2011-05-08T03:51:22Z")

</div>

Testing my login page, when I POST the wrong password I should expect a 401 Unauthorized http status code back. Here is the session#create controller method where I use :status =\> :unauthorized (using sproutcore, so I'm returning JSON):

&nbsp;&nbsp;def create &nbsp;&nbsp;&nbsp;&nbsp;user = User.authenticate(params[:email], params[:password]) &nbsp;&nbsp;&nbsp;&nbsp;if user.nil? &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;puts("debug: user did not authenticate")

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;respond\_to do |format| &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;format.json do &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;render(:json =\> {:status =\> :unauthorized}) ##### return 401 ###### &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end

&nbsp;&nbsp;&nbsp;&nbsp;else &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;puts("user: #{user}") &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;sign\_in(user) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;respond\_to do |format| &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;format.json do &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;render(:json =\> {:content =\> json\_for\_user(user), :location =\> user\_path(user)}) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end &nbsp;&nbsp;&nbsp;&nbsp;end &nbsp;&nbsp;end

here's what the WEBrick console is showing me:

Started POST "/sessions" for 127.0.0.1 at 2011-05-07 23:28:36 -0400 &nbsp;&nbsp;Processing by SessionsController#create as JSON &nbsp;&nbsp;Parameters: {"email"=\>"a@b.com", "password"=\>"[FILTERED]"} &nbsp;&nbsp;User Load (0.4ms) SELECT "users".\* FROM "users" WHERE "users"."email" = 'a@b.com' LIMIT 1 Completed 200 OK in 29ms (Views: 1.7ms | ActiveRecord: 0.4ms)

here is what Sproutcore is getting back:

~ PROXY: POST 200 /sessions -\> [http://localhost:3000/sessions](http://localhost:3000/sessions) &nbsp;&nbsp;&nbsp;content-type: application/json; charset=utf-8 &nbsp;&nbsp;&nbsp;etag: "0bfdc0989b2b4dfb5706ab29694db1cc" &nbsp;&nbsp;&nbsp;cache-control: max-age=0, private, must-revalidate &nbsp;&nbsp;&nbsp;x-ua-compatible: IE=Edge &nbsp;&nbsp;&nbsp;x-runtime: 0.049420 &nbsp;&nbsp;&nbsp;server: WEBrick/1.3.1 (Ruby/1.9.2/2011-02-18) &nbsp;&nbsp;&nbsp;date: Sun, 08 May 2011 03:28:36 GMT &nbsp;&nbsp;&nbsp;content-length: 25 &nbsp;&nbsp;&nbsp;set-cookie: \_mercury\_session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiIlZWEzNjk0YTA0NDQyYjZhYTE5MjJlOWRkMDU2NWEyMmM%3D--d117484163dcb37bcc5928c2edd4d0a9ad4bcda2; path=/; HttpOnly

Why isn't rails sending back a 401? Am I doing something wrong?

Michael

Why would the web server

---

<div class="post-metadata">

**Author:** ![Frederick\_Cheung](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/frederick_cheung/32/3901_2.png) [@Frederick\_Cheung](https://discuss.rubyonrails.org/u/Frederick_Cheung)\
**Post date:** [May 8, 2011, 9:11am UTC](https://discuss.rubyonrails.org/t/webrick-sending-wrong-http-status-code/58852/2 "2011-05-08T09:11:54Z")

</div>

> Testing my login page, when I POST the wrong password I should expect a 401 Unauthorized http status code back. Here is the session#create controller method where I use :status =\> :unauthorized (using sproutcore, so I'm returning JSON):

What your code is actually doing is producing a 200 response, whose body is {status: "unauthorised"}.

The http status to return goes at the top level, eg render :status =\> :unauthorized, ... (you can use the head method if you don't want to provide a body, eg head :unauthorized )

Fred

---

<div class="post-metadata">

**Author:** ![Michael\_Hanna](https://avatars.discourse-cdn.com/v4/letter/m/54ee81/32.png) [@Michael\_Hanna](https://discuss.rubyonrails.org/u/Michael_Hanna)\
**Post date:** [May 8, 2011, 7:36pm UTC](https://discuss.rubyonrails.org/t/webrick-sending-wrong-http-status-code/58852/3 "2011-05-08T19:36:28Z")

</div>

Thanks, this helped. For future reference, the code I wrote that worked is:

format.json {head(:unauthorized)}

Michael