Update authorization.md

website/src/docs/hotchocolate/security/authorization.md

@@ -108,6 +108,32 @@ type User @authorize {
 Specified on a type the `@authorize` directive will be applied to each field of that type. Its authorization logic is executed once for each individual field, depending on whether it was selected by the requestor or not. If the directive is placed on an individual field, it overrules the one on the type.
 
 If we do not specify any arguments to the `@authorize` directive, it will only enforce that the requestor is authenticated, nothing more. If he is not and tries to access an authorized field, a GraphQL error will be raised and the field result set to `null`.
+
+  > ⚠️ Note: Using the @authorize directive, all unauthorized requests by default will return status code 200 and a payload like this:
+   ```json
+   {
+     "errors": [
+       {
+         "message": "The current user is not authorized to access this resource.",
+         "locations": [
+           {
+             "line": 2,
+             "column": 3
+           }
+         ],
+         "path": [
+           "welcome"
+         ],
+         "extensions": {
+           "code": "AUTH_NOT_AUTHENTICATED"
+         }
+       }
+     ],
+     "data": {
+       "welcome": null
+     }
+   }
+   ```
 
 ## Roles
 
@@ -335,7 +361,7 @@ public class Startup
 
 This method also accepts [roles](#roles) and [policies](#policies) as arguments, similiar to the `Authorize` attribute / methods.
 
-Please note that this will prevent unauthorized access to all middleware included in `MapGraphQL`. This includes our GraphQL IDE Banana Cake Pop. If we do not want to block unauthorized access to Banana Cake Pop, we can split up the `MapGraphQL` middleware and for example only apply the `RequireAuthorization` to the `MapGraphQLHttp` middleware.
+> ⚠️ Note: Unlike the `@authorize directive` this will return status code 401 and prevent unauthorized access to all middleware included in `MapGraphQL`. This includes our GraphQL IDE Banana Cake Pop. If we do not want to block unauthorized access to Banana Cake Pop, we can split up the `MapGraphQL` middleware and for example only apply the `RequireAuthorization` to the `MapGraphQLHttp` middleware.
 
 [Learn more about available middleware](/docs/hotchocolate/server/middleware)