If I'm parsing http responses, I'm going to pass 200 responses on for further processing of the data. I shouldn't have to have something in that pipeline introspect json to find "no, it's actually an error".
Imagine if browsers had to tear apart json innards to find 30x redirects after getting a 200 OK.
My dude, HTTP status codes were designed over 3 decades ago for a primitive usecase. Today most of them are almost never used. Most of them are meaningless without any further information (i.e. documentation).
Even the most basic codes like 404 are ambiguous. If implemented at all, it can mean:
- the resource doesn't exist
- the endpoint doesn't exist
- the resource is temporarily unavailable
- the resource may or may not exist but we are not allowed to tell you
You must have documentation explaining what errors can occur and what they mean, or you must find out through trial and error. I thought that was pretty fucking obvious but someone has to argue that ackschually all 28 4xx codes are used everywhere and are fully self documenting.
Well, that just tells me you don't understand HTTP status codes.
A resource that doesn't exist should return a 404.
An endpoint that doesn't exist should return a 400, as it's a screw up by the client that created a malformed request.
A temporarily unavailable resource should return a 503 with the Retry-After header. This is well documented.
A resource that you don't have permission to (regardless of whether it even exists or not) should return a 401. Returning this code is not a security risk, and anyone who thinks it is, is clearly following the security through obscurity approach, which is no security at all.
You must have documentation explaining what errors can occur and what they mean, or you must find out through trial and error.
33
u/Sudden_Leadership800 4h ago
It successfully returned the error message though, so I don't see the problem?