Questions › Networking/Security

HTTP methods and status codes

HTTP BasicsEasyNetworking/Security

Walk through the common HTTP methods and status-code families. What does each convey?

What it tests

Fluency with the vocabulary of HTTP — the semantics clients and servers rely on to communicate intent and outcome.

Approach & answer

HTTP is a request/response protocol where the METHOD states the client's intent and the STATUS CODE states the server's outcome. The common methods: GET retrieves a resource and must have no side effects (safe); POST submits data to create a resource or trigger processing; PUT replaces a resource entirely at a known URL (idempotent — repeating it lands the same state); PATCH applies a partial update; DELETE removes a resource (idempotent); HEAD is GET without a body (fetch just the headers, e.g. to check existence or size); OPTIONS asks what a resource supports and is the mechanism behind the CORS preflight. Status codes come in five families, and knowing the family tells you who's responsible: 1xx informational (rare, e.g. 100 Continue, 101 Switching Protocols for WebSocket upgrade); 2xx success — 200 OK, 201 Created (with a Location header for the new resource), 204 No Content (success, nothing to return); 3xx redirection — 301 Moved Permanently, 302/307 temporary redirect, and the important 304 Not Modified (your cached copy is still valid, sent in response to a conditional request); 4xx client errors — 400 Bad Request (malformed), 401 Unauthorized (you are not authenticated — misnamed, it really means unauthenticated), 403 Forbidden (authenticated but not allowed), 404 Not Found, 405 Method Not Allowed, 409 Conflict, 422 Unprocessable Entity, 429 Too Many Requests (rate limited); 5xx server errors — 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable, 504 Gateway Timeout. The distinction people most often get wrong is 401 vs 403: 401 means 'I don't know who you are, authenticate', 403 means 'I know who you are and you still can't'. Using the right code matters because caches, browsers, and clients act on them — a 301 gets cached and rewrites future requests, a 429 tells a well-behaved client to back off, a 405 advertises allowed methods in the Allow header.

Use this technique when

Designing an API's responses; debugging why a client mishandles a response; choosing the right status code.

Code

Methods:  GET(safe) HEAD  POST  PUT(idempotent) PATCH  DELETE(idempotent) OPTIONS

Status families:
  1xx info         100 Continue, 101 Switching Protocols (WebSocket upgrade)
  2xx success      200 OK, 201 Created, 204 No Content
  3xx redirect     301 Moved, 302/307 Found/Temp, 304 Not Modified (cache valid)
  4xx client error 400 Bad Request, 401 Unauthenticated, 403 Forbidden,
                   404 Not Found, 405 Method Not Allowed, 429 Too Many Requests
  5xx server error 500 Internal, 502 Bad Gateway, 503 Unavailable, 504 Timeout

401 = "who are you?" (authenticate)   403 = "I know you, still no"

References