What status can I return in an attempt to submit a form without a TOKEN?

Question

I’d like to know what the status http I must return to my application if someone is trying to forge a request via form.

The application I developed is done in Laravel 4 and I’m using that CSRF_TOKEN.

The CSRF_TOKEN serves to prefigure attacks of Cross-Site Request Forgery.

It would be correct to use some of the methods such as 400 - Bad Request, 503 - internal server error, or 403 - unauthorized access, if there is a forged requisition attempt? Or simply, I should not return any status http or error whatever?

Answer 1

On the basis of HTTP status code list and their descriptions I recommend.

400 - Invalid request (Bad request)

400 Invalid request (Bad Request) Order cannot be delivered due to incorrect syntax.

The fact of missing a parameter, the TOKEN, this message is the one that best describes the error that occurred during the request

Why not 403 Proibido (unauthorized access)?

403 Prohibited (unauthorized access)
The request was a legal request, but the server is refusing to respond to it. Unlike a 401 - Não autorizado(Unauthorized), authentication will make no difference.

In case it is not a denied access to a request or directory but the lack of a parameter in the request, so the lack of privileges does not best portray the failure in the request.

Why not 503 - internal server error?

503 Service unavailable (Service Unavailable)
The server is under maintenance or cannot account for the resource processing due to the system overload. This must be a temporary condition.

As in fact your server does not present any error this is not the best response to an improper access to a request.