mattupstate/flask-jwt — pull request #5 by kekssw (2014-03-22 11:10:26+00:00)
Title: Indicate authentication failures with '403 Forbidden'

Using flask-jwt I found useful to differentiate failed auth from wrong headers, or corrupted/expired tokens.

I'm not sure 403 is the best approach, as 401 typically used for this, but I Forbidden seems to be appropriate as well, so I choose it for the following reasons:
- Easiness of problem identifying, as 401 already indicates a query without auth header at all
- I don't think sending sending back "WWW-Authenticate" is very helpful in this case
- Assuming main library audience is APIs, automated retrials hardly possible

Anyway, I think it's more appropriate than default "400 Bad request", as request actually was fine from protocol point of view.