While testing a REST application deployed with API Gateway and Lambda, a login attempt with invalid credentials returns HTTP 405 METHOD_NOT_ALLOWED, even though the request method is correct for the resource. Which HTTP status code should the application return for invalid credentials?

HTTP 401 Unauthorized is the correct status code for authentication failures, such as invalid credentials. It indicates that the request lacks valid authentication credentials for the target resource. The application should return this code to clearly signal that the user failed to authenticate. HTTP 404 Not Found is incorrect because it signifies that the server cannot find the requested resource, which is not the case here. HTTP 503 Service Unavailable is incorrect as it indicates the server is temporarily unable to handle the request, often due to maintenance or overload, not an authentication issue. HTTP 505 HTTP Version Not Supported is incorrect because it means the server does not support the HTTP protocol version used in the request. The problem description states the method is correct, implying the protocol version is also acceptable. The current 405 METHODNOTALLOWED is also incorrect because the method itself is valid for the resource; the issue is with the credentials, not the method.