403 Forbidden: The request was valid, but the server refuses action. This may be due to the user not having permission to a resource or needing an account of some sort, or attempting a prohibited action (e.g. creating a duplicate record where only one is allowed). This code is also typically used if the request provided authentication by answering the WWW-Authenticate header field challenge, but the server did not accept that authentication. The request should not be repeated. This code differs from 401 in that while 401 is returned when the client has not authenticated, and implies that a successful response may be returned following valid authentication, 403 is returned when the client is not permitted access to the resource despite providing authentication such as insufficient permissions of the authenticated account. The Apache web server returns 403 in response to a request for URL paths that corresponded to a file system directory when directory listing is disabled and there is no Directory Index directive to specify an existing file to be returned to the browser. Some administrators configure the Mod proxy extension to block such requests and this will also return 403. IIS responds in the same way when directory listings are denied in that server. In WebDAV, 403 is returned if the client issued a PROPFIND request but did not also issue the required Depth header or issued a Depth header of infinity.