res.forbidden()This method is used to send a 403 ("Forbidden") response back down to the client, indicating that a request is not allowed. This usually means the user agent tried to do something it was not allowed to do, like change the password of another user.
return res.forbidden();
Like the other built-in custom response modules, the behavior of this method is customizable.
By default, it works as follows:
"Forbidden".if ( !req.session.userId ) {
  return res.forbidden();
}
- This method is terminal, meaning that it is generally the last line of code your app should run for a given request (hence the advisory usage of
 returnthroughout these docs).res.forbidden()(like other userland response methods) can be overridden or modified. It runs the response method defined inapi/responses/forbidden.js. If aforbidden.jsresponse method does not exist in your app, Sails will use the default behavior.