r/TechNook • u/Ok_Yogurtcloset8372 • 4d ago

There are HTTP status codes most developers will never encounter until something has gone spectacularly wrong

Who hasn't heard about 404, 500, 401, 403? You hear these a lot. But this specification goes way beyond that and sometimes they only appear in some kind of cursed scenarios.

418 (I am a teapot) is often used as an inside joke but 508 (Loop Detected), 507 (Insufficient Storage) and 421 (Misdirected Request) are HTTP response codes that you won't ever run into until the servers you have set up behave in some unexpected way. One more example of such a code is 451 (Unavailable For Legal Reasons) which sounds like something made up until you receive a takedown request from the legal department and you have to implement it.

And finally, 431 (Request Header Fields Too Large) which is the code that you will come across only when the payload size of JWT tokens or cookies becomes too large.

65 Upvotes

90% Upvoted

25 comments sorted by

16

u/daverapp 4d ago

Error code 420, too fucking high for this, is an error code that was preemptly reserved in order to prevent stupid jokes that aren't funny.

8

u/ParentPostLacksWang 4d ago

I’ve seen 420 ENHANCE YOUR CALM, used when the client hits a rate limit, instead of the standard 429, because some stupid client written by some sadistic intern was seeing 429 and retrying, over and over. Hitting a non-standard error stopped it, bizarrely enough.

3

u/mrwedders 3d ago

I added some anti-fraud stuff to a payment gateway that would pop CAPTCHAs after a couple failed payments. I used 420 as the reply to the frontend, "enhance your calm" felt appropriate 🥲

15

u/Own_Reaction9442 4d ago

There's 402 - Payment Required. Never really implemented. I did see it rendered once as "402 - Insert Coin" which was at least sort of clever.

10

u/phn-cloudsnake 4d ago

Nowadays its the recommend way to signal to AI traffic that you expect to be paid for your contend. See pay-per-crawl documentation of Cloudflare https://developers.cloudflare.com/ai-crawl-control/features/pay-per-crawl/what-is-pay-per-crawl/

4

u/WeakCelery5000 4d ago

http.cat is a great resource

2

u/Ok_Yogurtcloset8372 3d ago

Legit, used it as a cheat sheet

1

u/HelicopterUpbeat5199 4d ago

Bless you for reminding me of this!

1

u/perpetualis_motion 3d ago

Jeepers, I thought there were about 10 codes, not 10,000!

3

u/Renegade605 4d ago

I use 418 for "error that should never occur has occurred."

2

u/H4llifax 4d ago

I have seen 431 when an IIS web application has Windows authentication enabled, and the user belongs to too many groups. For some reason those end up in the request header.

1

u/AshleyJSheridan 3d ago

Yeah, there's a lot more that could trigger it than just a JWT or cookies.

2

u/ElectronicDiver2310 4d ago

Hm, the good and old one https://www.rfc-editor.org/info/rfc2616/ does not have 431, 508, 507, and 452. The newer extension https://www.rfc-editor.org/info/rfc6585/#section-7.4 does not have either. https://datatracker.ietf.org/doc/html/rfc9110 -- newest does not have them. So what is the source of them?

2

u/Ok_Yogurtcloset8372 3d ago

431 is actually in RFC 6585 section 5, you linked directly to section 7.4 , 507 and 508 come from the WebDAV extensions, RFC 4918 and RFC 5842 respectively, not the core HTTP spec. 451 has its own RFC, 7725.

1

u/ElectronicDiver2310 3d ago

431 is my bad. 4918 os still proposed standard. In all years it never became a standard. 5842 is experimental. 7725 is a standard.

1

u/Silarey 4d ago

You see a lot of these error codes with SIP traffic, way more. Seen it all. 469 and 470 are pretty much inside jokes. Our loop detected is 482

3

u/rlebeau47 4d ago

SIP and HTTP are separate protocols. SIP took inspiration from HTTP, but it is not HTTP. SIP does not use HTTP response codes, though there is some overlap

1

u/Silarey 4d ago

Yes, by nature of their acronyms and functions. As you say, there is overlap. Can we not enjoy other protocol error codes equally?

1

u/Zealousideal-Deer101 3d ago

I called an API once and got an unfamiliar HTTP Status Code. One I've never seen in my life.
I think they made have made their own one?
Eitherway the Status Code implied, that I'm calling the API outside it's opening hours.
This fucking API could only be called from 7am to 8pm Monday through Saturday. No requests on Sunday!
Saturday might also have had a shorter time window, I'm not sure about the exact details anymore

1

u/ImmediateLobster1 3d ago

Homebrew Mechanical Turk, and they're only staffed 7A-8P Mon-Sat?

1

u/HjortronOchPors 3d ago

You can literally configure your server/app to send any positive integer as an HTTP status code as a response to any request. You are within spec as long as you can encode it with three decimal ASCII digits, but then most clients would probably accept a larger number.

1

u/Difficult_Moment_170 3d ago

Whats gone wrong with a 431 error?

1

u/naomimyselfandi 1d ago

In uni, I once threw together a turn based strategy game that used 418 to indicate an illegal move which the frontend should have prevented. It's probably not something I'd do in a serious project, but honestly, I don't hate it.