HTTP 403 instead of 401 when authentication is configured without Require directive

Authorization denial without explicit Require policy

In Apache HTTP Server 2.4, when a <Directory> or <Location> section includes authentication directives such as AuthType Basic and AuthName but lacks any Require directive, mod_authz_core denies access with HTTP 403 Forbidden rather than returning 401 Unauthorized to prompt for credentials.

This behavior stems from the 2.4 authorization model where Require directives implement least-privilege authorization rules. Without an explicit rule, the core cannot determine whether the absence of credentials or the absence of an authorization policy should trigger the response.

The 2.2 Order/Allow/Deny syntax was replaced by the 2.4 Require directive, so legacy configurations migrated without explicit Require directives may exhibit this 403 behavior unexpectedly.

Unresolved question: Should Apache return 401 Unauthorized to prompt for credentials, or is 403 Forbidden the correct response when authentication is configured but no authorization policy exists?

• Is this 403 behavior intentional design or an edge case in the authorization flow?
• Does the lack of credential prompting violate the expected authentication handshake?
• Are there documented migration guidelines for handling this scenario when upgrading from 2.2 to 2.4?