The Hidden Logic of HTTP Status Codes

· 4 min · 896 words

topic/technology

0. The Taxonomy of HTTP

HTTP status codes are the “shorthand” of the internet. Defined by RFC 9110 (and its predecessors), these three-digit integers allow servers and browsers to communicate complex states instantly.

1xx: Informational (Request received, continuing process)

  • 100 Continue: Go ahead with the request body.
  • 101 Switching Protocols: Switching to something else (e.g., WebSockets).
  • 102 Processing: I’m working on it (WebDAV).
  • 103 Early Hints: Pre-loading headers before the final response.

2xx: Success (The action was successfully received)

  • 200 OK: The gold standard. Everything worked.
  • 201 Created: Request fulfilled, new resource created.
  • 202 Accepted: Request accepted, but not yet finished.
  • 203 Non-Authoritative Information: Proxy modified the original response.
  • 204 No Content: Success, but there’s nothing to show you.
  • 205 Reset Content: Success, please clear your input fields.
  • 206 Partial Content: Delivering just the slice of data you asked for.
  • 207 Multi-Status / 208 Already Reported: WebDAV extensions for complex states.
  • 226 IM Used: Instance-manipulation applied.

3xx: Redirection (Further action needed)

  • 300 Multiple Choices: Pick one of these several options.
  • 301 Moved Permanently: Update your bookmarks; it’s gone for good.
  • 302 Found: It’s here for now (often misused as a temporary move).
  • 303 See Other: Go look at this other URI instead.
  • 304 Not Modified: You already have the latest version in your cache.
  • 305 Use Proxy / 306 (Unused): Legacy codes for proxy routing.
  • 307 Temporary Redirect / 308 Permanent Redirect: The “modern” versions of 302/301 that preserve the request method (POST stays POST).

4xx: Client Error (You messed up)

  • 400 Bad Request: General syntax error in your request.
  • 401 Unauthorized: You need to log in.
  • 402 Payment Required: Reserved for future digital payment systems.
  • 403 Forbidden: I know who you are, but you aren’t allowed here.
  • 404 Not Found: The resource doesn’t exist (see the CERN Myth below).
  • 405 Method Not Allowed: You can’t POST to a read-only resource.
  • 406 Not Acceptable: I don’t have the file format you asked for.
  • 407 Proxy Authentication Required: Log in to your proxy first.
  • 408 Request Timeout: You took too long to send the request.
  • 409 Conflict: Edit collision (e.g., two people saving at once).
  • 410 Gone: It was here, but it’s deleted and never coming back.
  • 411 Length Required: Tell me how big the request body is.
  • 412 Precondition Failed: You set a condition I can’t meet.
  • 413 Payload Too Large: Your upload is too big.
  • 414 URI Too Long: Your URL is absurdly long.
  • 415 Unsupported Media Type: I don’t understand this file type.
  • 416 Range Not Satisfiable: You asked for a byte range I don’t have.
  • 417 Expectation Failed: I can’t meet your Expect header.
  • 418 I’m a Teapot: The legendary April Fools’ joke (see below).
  • 421 Misdirected Request: Request sent to a server that can’t produce a response.
  • 422 Unprocessable Entity / 423 Locked / 424 Failed Dependency: WebDAV errors.
  • 425 Too Early: Don’t replay this request.
  • 426 Upgrade Required: You need a better protocol (like TLS).
  • 428 Precondition Required / 429 Too Many Requests / 431 Fields Too Large: Modern safety limits.
  • 451 Unavailable For Legal Reasons: Government censorship or DMCA (see Bradbury below).

5xx: Server Error (I messed up)

  • 500 Internal Server Error: The “blue screen” of the web. Something broke.
  • 501 Not Implemented: I don’t even know how to handle that request.
  • 502 Bad Gateway: I’m a proxy, and the server behind me failed.
  • 503 Service Unavailable: Overloaded or down for maintenance.
  • 504 Gateway Timeout: The server behind me took too long.
  • 505 HTTP Version Not Supported: I don’t speak that version of HTTP.
  • 506 Variant Also Negotiates / 507 Insufficient Storage / 508 Loop Detected: Advanced server-side failures.
  • 510 Not Extended: More extensions needed.
  • 511 Network Authentication Required: You need to sign into the Wi-Fi portal.

1. 404 Not Found: The “Room 404” Myth

A persistent urban legend claims that the code 404 was named after “Room 404” at CERN, which supposedly housed the first web servers. Robert Cailliau (co-creator of the Web) has confirmed this is a myth. Codes were assigned logically: 4 for client error, 04 for the fourth type defined.

2. 418 I’m a Teapot: The Joke that Won’t Die

Defined in 1998 (RFC 2324) as an April Fools’ joke for the “Hyper Text Coffee Pot Control Protocol.” When developers tried to remove it in 2017, a “Save 418” movement ensured it remains a reserved status code today to honor internet history.

Approved in 2016, this code signals that a resource is blocked for legal reasons. It is a direct reference to Ray Bradbury’s Fahrenheit 451, a novel about the suppression of ideas through the burning of books.

4. 200 OK: The “Soft 404” Problem

A Soft 404 occurs when a server returns a 200 OK status for a page that doesn’t exist (e.g., displaying an error message on a successfully loaded page). This confuses search engines and is considered poor practice; a true 404 or 410 should be used instead.