HTTP status codes and secrets in the browser

Two areas of HTTP are routinely confused in frontend code.

401 and 403 differ. 401 means the request carried no valid credentials: the server does not know who you are, and signing in may resolve it. 403 means it knows and the answer is still no. Showing a sign-in prompt on a 403 sends the user round a loop that cannot succeed; treating a 401 as permanent signs them out of something they could have reached.

404 is sometimes the correct answer to a permission question. Returning 403 confirms that a resource exists. Where that fact is itself sensitive, 404 is appropriate, since it matches the response an unauthorised party would receive for something that does not exist.

Anything shipped to a browser is public. A key in a JavaScript bundle, in an environment variable inlined at build time, or in a network request is readable by any visitor with developer tools. Minification is not encryption. A value that must remain secret belongs on a server which holds it and returns only the result.

Permissions are enforced where the data is. A check performed in the client is a convenience for legitimate users. On this platform enforcement sits in row-level security and in server-side functions, and eligibility for the certificate is calculated in the database rather than in the page.