Config data files in asp.net). its both that or even a 404. imho, it wouldn't be suitable to return 403 for something that can be accessed but you simply didn't have the best qualifications. my Remedy will be to give an entry denied message using a way to alter qualifications. https://riverovadh.p2blogs.com/35303367/how-much-you-need-to-expect-you-ll-pay-for-a-good-asset-protection