preview draft access denied html status code is 500 instead of 401

[graymouser]

When logged out attempting to view an edit post 'preview changes' link (i.e. link with ending like ?preview_id=7954&preview_nonce=5fd05f823e&post_format=standard&_thumbnail_id=7963&preview=true) shows;

"Sorry, you are not allowed to preview drafts."

Which is correct, however the HTML status code returned is 500 (internal server error), whereas I believe it should actually be 401 (unauthorized).

Another option would be to have it the same as the edit post link which redirects to login page for non-logged in users.

Easy way to test is to edit a post, click on 'preview changes' then copy paste the preview url into a new private browsing window.

The reason this is relevant is Google Search Console/Webmaster tools reports this as an error in site crawls.

[graymouser]

Patch from ​https://github.com/WordPress/WordPress/pull/353

[graymouser]

I used this tool to submit a potential fix;
​https://wptavern.com/submit-pull-requests-to-wordpress-core-with-the-github-to-patch-utility
​https://rmccue.io/patch/

[johnbillion]

Thanks for the patch @graymouser, and welcome to WordPress Trac!

[ocean90]

The response code can also be defined as the second argument of wp_die(), see [30355]. Maybe 400 would be a better code since authorisation isn't checked here.

[pento]

We've used 403 in the past for failed nonce checks (rest_cookie_check_errors(), check_ajax_referer(), and anything that calls wp_nonce_ays()).

[pento]

In 44610:

Posts: Set a HTTP 403 error when an incorrect post preview nonce is sent.

Props graymouser.
Fixes #43570.