arkyn
ChangelogGuides
docs / bad-responses / forbidden

Forbidden

The Forbidden class represents an HTTP error response with status code 403. It is used to standardize "Forbidden" error responses, typically when the user is authenticated but lacks permission to access the requested resource.

Import

ts

import { Forbidden } from "@arkyn/server/forbidden";
Learn how subpath and root imports differ in How do I use imports.

Constructor

  • message (required): A descriptive message explaining the reason for access denial.
  • cause (optional): Additional information about the error cause, which can be any serializable data.

Methods

toResponse() - Converts the instance into a Response object with JSON body and Content-Type: application/json header.
toJson() - Alternative method using Response.json() for generating the JSON error response.

Usage example

typescript

import { Forbidden } from "@arkyn/server/forbidden";


// Basic usage - throw the error
throw new Forbidden("You don't have permission to access this resource");


// With cause information
throw new Forbidden("Admin access required", {
    requiredRole: "admin",
    userRole: "member",
});


// Convert to Response object
const error = new Forbidden("Access denied to this feature");
return error.toResponse();


// Using toJson alternative
return error.toJson();

Response structure

The response body follows a standardized structure:

json

{
    "name": "Forbidden",
    "message": "You don't have permission to access this resource"
}
This is sent with HTTP status 403, set on the Response object itself, the status code is not part of the JSON body.
If a cause is passed to the constructor, it is included in the body as well:

json

{
    "name": "Forbidden",
    "message": "Admin access required",
    "cause": { "requiredRole": "admin", "userRole": "member" }
}

Notes

When thrown, this class automatically emits a debug log to the console showing the file and function where the error originated. See DebugService to configure ignored files for accurate caller detection.
The cause parameter, when provided, is included in the response body under the cause key as-is, it is sent to clients, not just kept for server-side debugging. Since v3.0.12, cause is no longer serialized with JSON.stringify() first, it's stored and returned exactly as passed (an object stays a nested object, not a JSON-encoded string). See Breaking Changes.
Since v3.0.10, cause is omitted from the response body entirely when NODE_ENV === "production", to avoid leaking internal error detail to clients. message and name are unaffected in every environment. See Breaking Changes.
Use Forbidden (403) when the user is authenticated but lacks permission. Use Unauthorized (401) when the user is not authenticated at all.
Related in Bad responses
On this page
    arkyn