Practically nothing in the spec states in any other case, and infrequently You can not utilize a 401 in that problem simply because returning a 401 is just authorized should you include things like a WWW-Authenticate header. Condition-sponsored hackers provide the official backing of a country-condition. They operate that has http://pigpgs.com