Why return 200 [] on GET /rest/api/3/project when not logged in

Question

Is there a reason that Jira returns 200 empty list when no user is logged in? Wouldn't 401 be a more appropriate response code?

Some libraries rely on the response code being correct to do transparent authentication but they cannot guess that this 200 [] is actually a 401, case in point OkHttp.

Niranjan · Accepted Answer

Hi,

Not sure but what I could think of is that the code 200 indicates that the request has succeeded. It may or may not return empty results. There may be projects that can have open access (which may not need authentication) and in such cases it is not about authentication. While the response 401 code says that the request is not complete as it needs authentication, but doesn't have a valid one.

Pritam Kumar_nosrms · Accepted Answer

@Jens BjerreWelcome

To add to @Niranjan points, you can read this KB article to learn more - https://confluence.atlassian.com/adminjiraserver/allowing-anonymous-access-to-your-project-938847186.html