I\'m writing an authentication script in PHP, to be called as an API, that needs to return 200only in the case that it approves the request, and403(Forbid
only in the case that it approves the request, and
(Forbid
header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
You should not use 500, that indicates an internal server error.
This (and other headers) should be sent before any ouput, except if you have output buffering enabled.