The discussion revolves around whether a failed login attempt returning a 200 OK status code is a bug or intentional behavior. uckelman initiated the discussion, questioning the status code for a failed login. maiki suggested a 401 status code would be more suitable, but noted that the 200 OK status might indicate a successful POST request with feedback. Falco shared a related discussion on logging invalid login attempts. uckelman acknowledged the rationale behind returning a 200 OK status for a failed login, implying a “successful” failure. sam pointed out that this behavior can confuse bots and is undecided about changing it. uckelman clarified that they were seeking confirmation of the behavior’s intentionality, which they have now received.
I’m doing a POST to /session.json with the payload
{
"login": "skroob",
"password": "12345",
"authenticity_token": "..."
}
When login succeeds, the status is 200 and the JSON returned is a bunch of user data. When login fails, the JSON returned looks like
{"error": "Incorrect username, email or password"}
but the status is still 200. Is this a bug? Should the status for a failed login be something >= 400, to indicate a failure?
Maybe. I would probably go for 401.
But those are also HTTP status codes, for HTTP client connections; I think that nuance leads to decisions like returning a 200 (“your POST was successful, here is the feedback”).
Not sure, myself. 
I can see the rationale for a 200 on a failed login meaning that your login failed successfully, instead of failing unsuccessfully. 
Keep in mind this is also a bit of a “feature” in that it confuses bots that are trying to log in.
I am mixed on changing this. Maybe…
I’m not asking for a change. What I wanted was disjunctive: a change OR confirmation that the behavior is intentional—which I have now. Thanks!