A slate-roof guild API is reachable with no Authorization header. What should the developer implement so unauthenticated calls fail?
Select an answer to reveal the explanation.
Short Explanation
An open API with no header check is basically a unlocked door. Validate the Entra access token—or send back 401 and keep the guild’s data inside.
Full Explanation
Protected web APIs should require a bearer JWT issued by Microsoft Entra ID and validate issuer, audience, and lifetime before executing the request. Missing or invalid tokens map to HTTP 401 Unauthorized. Authorization failures for missing roles or scopes are typically HTTP 403 after a valid token is present.