HTTP 403 instead of 401 when authentication is configured without Require directive
Authorization denial without explicit Require policy In Apache HTTP Server 2.4, when a <Directory> or <Location> section includes authentication directives such as AuthType Basic and AuthName but lacks any Require directive, mod_authz_core denies access with HTTP 403 Forbidden rather than returning 401 Unauthorized to prompt for credentials. This