Http Response Codes

Http Response Codes

Which are HTTP Response Codes?

Response codes for the hypertext transfer protocol ( HTTP) are provided by a server in response to a server request. It includes IETF Request for Comments (RFCs) codes, as well as some additional codes which are commonly used in HTTP applications.

HTTP status codes state whether a specific HTTP request has been completed successfully. In general, the responses are grouped into five classes:

CATEGORYDESCRIPTION
1xx: InformationalCommunicates transfer protocol-level information.
2xx: SuccessIndicates that the client’s request was accepted successfully.
3xx: RedirectionIndicates that the client must take some additional action in order to complete their request.
4xx: Client ErrorThis category of error status codes points the finger at clients.
5xx: Server ErrorThe server takes responsibility for these error status codes.

The status codes 1xx class are informative and indicate a request has been received and understood. It is issued as a temporary status, while the process remains under way. It also tells customer to wait for a final response. Such messages are the status line as well as the optional header fields.

The 2xx range of codes generally means that the request has been successfully received, understood and accepted while the 3xx range of codes indicates that additional action must be taken by the client to complete the specific request. This is also utilized in redirecting the URL.

The 4xx status codes class is tailored to cases where the client seems to have caused the mistake. Such status codes refer to any request form, and the user agents will show the user any entity involved.

The 5xx set of codes applies to server error codes indicating that the request was accepted but that an error occurred preventing the server from satisfying the request.

While there is a long list of HTTP error codes, you can probably only find about a dozen of them. But once you understand what they mean, you ‘re going to know what it takes to fix them.

We’ll look at the different HTTP response codes more closely and what they mean.

Information Responses

In this family, HTTP answer codes are only for more detail, just to indicate that a particular process has been completed or a request has been completed. It is unusual that HTTP status codes are used within this set, as most specify seemingly boring processes. Examples of these HTTP status codes include the most basic: 100: Continue, meaning the server will continue as usual, and 102: processing, meaning the request will be handled by either the server or the client (the client is the receiving entity). As you can see, these two data codes are part of the usual procedure, why do they need to define HTTP response code? Such HTTP codes help monitor the data routes in the server output as a whole. There will be no signposts for different processes without these HTTP status codes, so log browsing transforms into a guessing game. HTTP answer codes from 100 – 199, after all, have a valid use.

100 Continue

The response would mean that all is ok so far and that there are no other problems so that the request can proceed. Nevertheless, if the request has already been completed the client may also ignore the response.

101 Switching Protocols

This answer suggests that the code is sent from the client in response to an update request header, which shows the protocol to which the servers turn.

102 Processing (WebDAV)

This code indicates that the server has already received the request, and is currently processing it, but no response is yet available.

103 Early Hints

This HTTP response code is used predominantly for the Connection header, allowing the user agent to preload resources while the server prepares a response.

Successful Responses

HTTP error codes are showing success in various forms under this family. HTTP response codes 200 – 299 are bearers of good news: an application has been approved, a new request has been created or a issue has been resolved. Since the earlier group’s HTTP status codes act as signposts, the 200 group’s HTTP status codes act as goal signals for specific actions to continue as necessary requests were made possible. 202: Approved indicates the customer has received the demand. The HTTP response code 202 does not necessarily indicate that the request is submitted, but what is critical is that it is processed. These HTTP status codes include 206: Partial Content. That means the requirement is partially fulfilled, but nevertheless met.

200 OK 

This status code indicates positive appeal. The significance of the particular HTTP method ‘s success:

  • GET: the resource was fetched and is being transmitted
  • HEAD: the entity headers are in the message body
  • PUT or POST: the resource describing the result of the action is transmitted in the message body
  • TRACE: the message body contains the request message as received

This means that the waste was successful and as a result , a new tool was created. This is typically a response sent after requests for a POST, or some requests for a PUT.

201 Created

The request for processing was approved but the processing was not completed. Eventually, the request may be acted upon and may be disallowed when processing takes place. This is meant for cases where the requests are handled by another process or server, or for batch processing.

202 Accepted

The request for processing was approved but the processing was not completed. Eventually, the request may be acted upon and may be disallowed when processing takes place. This is meant for cases where the requests are handled by another process or server, or for batch processing.

203 Non-Authoritative Information

This status code simply means that the meta information returned is not exactly the same as the information available from the origin server, but is obtained from a copy of a local or a third party. That is mostly useful for other resource backups.

204 No Content

This status code shows where no content is sent for a particular request, although the headers may be useful. The user agent can update its cached headers with new ones for this resource.

205 Reset Content

This status code dictates that the user agent resets the document that sent the message.

206 Partial Content

This response code is used when the Client sends the Range header to request only part of a resource.

207 Multi-Status (WebDAV)

This status code provides multiple , independent operations information. The message of the is an XML message by default and can provide different response codes, depending on how many sub-requests were made.

208 Already Reported (WebDAV)

Used inside a response element to avoid repeated enumeration of multiple bindings to the same collection of internal members.

226 IM Used (HTTP Delta encoding)

A GET request for the resource has been fulfilled by the server, and the answer is a representation of the outcome of one or more instance manipulations applied to the instance.

Redirection Messages

HTTP status codes 300-399 discuss redirect. For various reasons, these HTTP response codes imply that the request had to be redirected. 300 – 399 HTTP status code may require immediate action, as the redirection may be a pending request, and the web browser might be stuck somewhere. 300: Multiple choices make it confusing for the web browser to choose where to go, so you have to take direct action. 310: Resource Moved Permanently means the route of the request will change in good time from that point on.

300 Multiple Choice

This requested resource corresponds to any of a series of representations, each of which has its own particular location and information. This is provided to allow the user agent to select a particular representation and then redirect the request to that location.

301 Moved Permanently

This HTTP response code indicates that the resource that is requested has permanently modified its unique URL. In the reply the new URL is given.

302 Found

This code indicates that the resource requested was temporarily transferred to the URL. Future changes in the URL could also be made, so the same URL should be used in future requests. This is an example of industry practice that contradicts the norm.

303 See Other

When receiving this status code, it means that with a GET request, the server will send the response to direct the client to get the requested resource at another Address.

304 Not Modified

It means that a conditional request has been made by the client and access is allowed, but records have not been changed and the server should be responding with status code. It is necessary to remember that the answer 304 does not contain the body of the message, so that it is always terminated after the header fields by the first empty line.

305 Use Proxy

This code is classified as an earlier version of the HTTP specification indicating that proxy access is needed to the requested response. It was deprecated because of security concerns regarding a proxy’s in and configuration.

306 unused

The code is not used anymore. It used to mean that the specified proxy should be used with sub requests.

307 Temporary Redirect

This means that the request should be replicated with another URI for that status code. Any future requests will still be using the initial URI, however. It is exactly like the 302 Found HTTP application, but with the exception that the user agent does not have to modify the form used for HTTP. If a POST was used in the first submission, the second request must have a POST used.

308 Permanent Redirect

This status code means that the resource is not stored permanently on another URL. The Location must define this: HTTP Response Header. It is just like the 301 permanently moved response code, with the exception that the user agent does not alter the form used for HTTP. If a POST was used in the first submission, the second request must have a POST used.

Client Error Responses

400 (Bad Question)

400 is the generic error status on the client side, used when no other 4xx error code is suitable. Errors can be such as malformed request grammar, invalid request message parameters, or tricky request routing etc.

The client DO NOT repeat the request unchanged.

401 Unauthorized

A answer to a 401 error suggests that the client has attempted to work on a protected resource without providing the necessary authorisation. It could have given the wrong credentials, or none at all. The response must include a WWW-Authenticate header field which contains a challenge that is applicable to the resource requested.

The client MAY repeat the request with an appropriate header Authorization field. If Authorization credentials have already been included in the submission, then the 401 response suggests that those credentials have been denied authorisation. If the 401 response contains the same challenge as the previous response, and the user agent has already attempted authentication at least once, then the user SHOULD will be faced with the entity provided in the response as that entity the contain relevant diagnostic data.

402 Payment Required

This answer code is for future use only. The initial objective was to use it for digital payment systems; however, the code is rarely used, and there is no standard for it.

403 Forbidden

A 403 error response indicates that the client request is correctly formed, but the REST API refuses to honor it, i.e. the user does not have the resource permissions. A 403 response is not a case of inadequate customer credentials; that would be 401 (‘Unauthorized’).

Authentication won’t help, and DO NOT repeat the request. Unlike a 401 Unauthorized response, authenticating won’t make any difference.

404 Not Found

The 404 error status code shows that the REST API is unable to map the Url of the client to a resource but may be available for potential use. Subsequent customer requests are admissible.

No indication is given as to whether the condition is permanent or temporary. The 410 (Gone) status code SHOULD will be used if the server knows that an old resource is permanently unavailable and has no forwarding address, through some internally configurable mechanism. This status code is typically used when the server does not want to disclose precisely why the request was rejected, or when there is no other answer to it.

405 Method Not Allowed

The API responds with an error of 405 indicating that the client has attempted to use an HTTP method which the tool does not allow. For example, a read-only resource could only support GET and HEAD, whereas a controller resource could allow GET and POST but not PUT or DELETE.

A 405 answer must include the Allow header which lists the resource-supporting HTTP methods. For instance:

Permit: GET, POST

406 Not Acceptable

The 406 error response indicates that, as indicated by the Accept request header, the API is not able to produce any of the desired media types on the device. For example, if the API is only willing to format data as application / json, a client request for data formatted as application / xml will receive a response of 406.

If the response may be inappropriate, a user agent Must temporarily stops collecting further data and asks the user for more action decisions.

407 Proxy Authentication Required

This response code is very similar to the 401 code, but proxy authentication is required.

408 Request Timeout

This response is normally sent via the idle link of some server, often without the client making any previous request. When web browsers such as Chrome and Firefox use HTTP link mechanisms to speed up browsing, this basically means the server wants to close the idle link and the response is being used much more these days. Notice also that some servers can terminate the connection without issuing this notice.

409 Conflict

This response he sent to the server when a request conflicts with the server’s current state.

410 Back

This error notes that the requested resource is no longer available and will not be available again. This code should be used if a resource has been deleted deliberately, and the resource should not be purged. Upon obtaining a 410 status code, the customer will not request this tool again in the future. Clients like search engines can have the tool eliminated.

411 Length Required

This response simply means the request did not indicate a connection to the content needed by the resource requested.

412 Precondition Failed

The 412 error response shows that in its request headers, the client specified one or more preconditions, essentially informing the REST API to execute its request only if those requirements have been met. A response from 412 indicates that certain requirements have not been met, so instead of executing the request, the API sends the status code.

413 Payload Too Large

Demand entity is larger than server-defined limits; the server may either close the connection or return a Retry-After header field.

414 Too long on URI

The request is bigger than that which the server is willing or able to handle. Previously named “Too Big Software Unit”

415 Unsupported Media Type

The response to the 415 error indicates that the API is unable to process the type of media supplied by the client, as indicated by the request header Content-Type. For example, if the API is only willing to process data formatted as the application / json, a client request including data formatted as application / xml will receive a 415 response.

The client uploads an image, for example, as image / svg+xml, but the server demands that images use a different format.

The server refuses to process the request because the user entity is for the requested method in a format not accepted by the requested resource.

416 Range Not Satisfiable

The range defined in the request by the Scope header field can not be fulfilled; it is possible the scope is outside the size of the data of the target URI.

417 Expectation Failed

The server can not fulfill the request-header requirements of the Expect sector.

418 I’m a Teapot

The server refuses the attempt to brew a teapot with the coffee. In 1998, that code was defined as one of the traditional jokes of the IETF April Fools.

421 Misdirected Request

The request was addressed to a server which can not produce a response. It may be submitted by a server that is not designed to deliver responses that are included in the request URI for the combination of scheme and authority.

422 Unprocessable Entity (WebDAV)

The request was well-formed but due to semantum errors could not be followed. For example, this condition of error may occur if there are well-formed (i.e., syntactically correct) but semantically erroneous XML instructions in the body of a request.

423 Locked (WebDAV)

Access to the resource is locked.

424 Failed Dependency (WebDAV)

The request failed as it was based on another request and failed.

425 Too Early

Specifies that the server is not prepared to risk losing a request that could be replayed.

426 Upgrade Required

The server refuses to use the current protocol to execute the request but may be able to do so after the client switches to another protocol. In a 426 response, the server sends an Upgrade header indicating the protocol(s) required.

428 Precondition Required

The server of origin requires conditionality to the submission. Intended to avoid the ‘lost update’ problem where a client GETs the state of a resource, modifies it, and PUTs it back to the server when a third party has changed the state on the server meanwhile leading to a conflict.

429 Too Many Requests

The 429 status code indicates that, within a given period of time, the user has submitted too many requests (“rate limit”). SHOULD ‘s response representations provide information describing the situation, and MAY contains a Retry-After header indicating how long to wait before creating a new submission. If a server is under attack or simply receives a very large number of requests from a single user, it will consume resources to respond to each with a 429 status code.

431 Request Header Fields Too Large

The 431 status code indicates that since its header fields are too large, the server is reluctant to process the request. The request Will will be resubmitted after the code header fields are reduced in size. This can be used both when the total collection of request header fields is too wide, and when the fault of a single header field. In the latter case, which header area was too wide should be defined by the answer representation.

451 Unavailable for Legal Reasons

The user-agent asked for a tool that can not be legally given, such as a government-censored website. It is also a nod to the 1953 novel Fahrenheit 451, where books are banned, and the paper temperature of autoignition is 451 ° F.

Server Error Responses

500 Internal Server Error

500 is an error response common to the REST API. With this response status code, most web frameworks automatically react whenever they execute any request handler code which raises an exception.

A 500 error is never the responsibility of the client and, therefore, it is fair for the client to retry the same request that caused this response and to expect to obtain a different answer.

API answer is the generic message of error given when an unexpected condition has been encountered and no more precise message is available.

501 Not Implemented

The server either does not recognize the request method, or the ability to satisfy the request is lacking. It typically means future functionality (for example , a new feature of a web-service API).

502 Bad Gateway

400 is the generic error status on the client side, used when no other 4xx error code is suitable. Errors can be such as malformed request grammar, invalid request message parameters, or tricky request routing etc.

The client DO NOT repeat the request unchanged.

503 Service Unavailable

This error code applies to the server that was serving as a gateway or proxy and the upstream server received an incorrect reply.

504 Gateway Timeout

The server was acting as a gateway or proxy and the upstream server didn’t receive a timely response.

505 HTTP Version Not Supported

This status code means the server is not accepting the version of the HTTP protocol used in the request.

506 Variant Also Negotiates

This server error means that the application request agreement results in circular references.

507 Insufficient Storage (WebDAV)

The server can’t store the representation needed to complete the request.

508 Loop Detected (WebDAV)

The server terminated an operation because an infinite loop was encountered when processing a request with “Depth: infinity.” This status indicates the entire operation failed.

510 Not Extended

The resource access policy was not followed in the petition. All the information necessary for the client to issue an extended request should be sent back by the server.

511 Network Authentication Required

To obtain network access the client must authenticate. Designed to be used by intercepting proxies used to monitor network access (e.g. “captive portals” used to allow agreement to Terms of Service before providing complete Internet access through a Wi-Fi hotspot);

Other Important HTTP Status Codes

401 Unauthorized

A answer to a 401 error suggests that the client has attempted to work on a protected resource without providing the necessary authorisation. It could have given the wrong credentials, or none at all. The response must include a WWW-Authenticate header field which contains a challenge that is applicable to the resource requested.

The client MAY repeat the request with an appropriate header Authorization field. If Authorization credentials have already been included in the submission, then the 401 response suggests that those credentials have been denied authorisation. If the 401 response contains the same challenge as the previous response, and the user agent has already attempted authentication at least once, then the user SHOULD will be faced with the entity provided in the response as that entity the contain relevant diagnostic data.

403 Forbidden

A 403 error response indicates that the client request is correctly formed, but the REST API refuses to honor it, i.e. the user does not have the resource permissions. A 403 response is not a case of inadequate customer credentials; that would be 401 (‘Unauthorized’).

Authentication won’t help, and DO NOT repeat the request. Unlike a 401 Unauthorized response, authenticating won’t make any difference.

404 Not Found

The 404 error status code shows that the REST API is unable to map the Url of the client to a resource but may be available for potential use. Subsequent customer requests are admissible.

No indication is given as to whether the condition is permanent or temporary. The 410 (Gone) status code SHOULD will be used if the server knows that an old resource is permanently unavailable and has no forwarding address, through some internally configurable mechanism. This status code is typically used when the server does not want to disclose precisely why the request was rejected, or when there is no other answer to it.

405 Method Not Allowed

The API responds with an error of 405 indicating that the client has attempted to use an HTTP method which the tool does not allow. For example, a read-only resource could only support GET and HEAD, whereas a controller resource could allow GET and POST but not PUT or DELETE.

A 405 answer must include the Allow header which lists the resource-supporting HTTP methods. For instance:

Permit: GET, POST

406 Not Acceptable

The 406 error response indicates that, as indicated by the Accept request header, the API is not able to produce any of the desired media types on the device. For example, if the API is only willing to format data as application / json, a client request for data formatted as application / xml will receive a response of 406.

If the response may be inappropriate, a user agent Must temporarily stops collecting further data and asks the user for more action decisions.

412 Precondition Failed

The 412 error response shows that in its request headers, the client specified one or more preconditions, essentially informing the REST API to execute its request only if those requirements have been met. A response from 412 indicates that certain requirements have not been met, so instead of executing the request, the API sends the status code.

415 Unsupported Media Type

The response to the 415 error indicates that the API is unable to process the type of media supplied by the client, as indicated by the request header Content-Type. For example, if the API is only willing to process data formatted as the application / json, a client request including data formatted as application / xml will receive a 415 response.

The client uploads an image, for example, as image / svg+xml, but the server demands that images use a different format.

Mark Funk
Mark Funk is an experienced information security specialist who works with enterprises to mature and improve their enterprise security programs. Previously, he worked as a security news reporter.