A logged-in user can still receive 403 Forbidden if not authorized.
Practice this question from Quiz: Java Security, with options and an explanation.
Question
A logged-in user can still receive 403 Forbidden if not authorized.
Option A — Correct answer
True
Authorization checks permissions after identity is known.
Option B
False
Authorization checks permissions after identity is known.