HTTP status codes: what was the result of the request?

Objectives

By the end of the lesson, you can say the meaning of a common status code, distinguish client errors from server errors, recognize the kinds of redirection, and understand why HTTP success is not the same as business success.

Why do we need status codes?

Many things can happen to a request: the resource exists, it has moved, it does not exist, the requester is not logged in, or the server has broken. The client needs to know this in a machine-readable form, because it has to behave differently: display the content, follow the new address, ask for a login, or try again later. A status code is a three-digit number that gives a short, standard signal about the HTTP-level result of the request.

A missing course page

$ curl -i http://localhost:8080/kurzusok/regi
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=utf-8
...
<h1>Nem található</h1>

404 does not mean "there is no internet". Quite the opposite: the request reached a responding server, which cannot find the requested resource at the given address. The browser uses the code, and the human uses the explanation in the body (here the Hungarian "Nem található", "Not found").

The code families

The first digit of the code denotes a broad category:

Family	Meaning	Typical situation
1xx	Information	Processing is still going on
2xx	Success	The request was fulfilled at the HTTP level
3xx	Redirection or a further step	Use another address, use a cached copy
4xx	Client-side error	The request cannot be fulfilled as it is: missing resource, missing permission, bad request
5xx	Server-side error	The server could not fulfil an (otherwise valid) request

flowchart TB
    V[HTTP response] --> K{First digit of the status code}
    K -->|2| S[Success]
    K -->|3| T[A further step is needed]
    K -->|4| C[The request cannot be fulfilled as it is]
    K -->|5| H[Server-side error]
    K -->|1| I[Information]

A 4xx is not a moral judgment about the user, and a 5xx is not always the fault of a single server. The code family is only the first clue.

Success: 200, 201, 204

• 200 OK: the request succeeded, the response usually contains a body.
• 201 Created: a new resource was created (for example a successful enrolment); the Location header can give the address of the new resource.
• 204 No Content: the operation succeeded, but there is nothing to send back (for example a deletion).

$ curl -i -X DELETE http://localhost:8080/jelentkezesek/1
HTTP/1.1 204 No Content
Date: Sun, 11 Oct 2026 16:47:26 GMT

Redirection: 301, 302, 303, 307, 308, and 304

A redirect tells the client to continue at another address, and the Location header gives the new address:

$ curl -iL http://localhost:8080/kurzusok
HTTP/1.1 301 Moved Permanently
Location: /kurzusok/webprog
...

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
...
<h1>Webprogramozás 1.</h1>

(The -L switch tells curl to follow the redirect; the browser does this by itself. That is why the network panel shows two requests for opening a single page.)

The different codes differ in two things: whether the move is permanent or temporary, and whether the client preserves the method. According to RFC 9110, with 301 and 302 the client may change POST to GET (for historical reasons), 303 signals that the result must be fetched with GET, and 307 and 308 forbid changing the method.

Code	Permanent?	Method preserved	Typical use
301 Moved Permanently	permanent	may change (POST → GET)	the page has moved to a new address for good
302 Found	temporary	may change	temporary redirect
303 See Other	–	GET	redirecting to the result page after submitting a form
307 Temporary Redirect	temporary	preserved	temporary redirect without changing the method
308 Permanent Redirect	permanent	preserved	permanent redirect without changing the method

304 Not Modified is of a different nature: in a cache check it signals that the previously stored copy can still be used (chapter 10).

The request cannot be fulfilled: 4xx

Code	Meaning	What can the client do?
400 Bad Request	The request is faulty (for example an invalid format).	Fix the request.
401 Unauthorized	Authentication is missing or invalid.	Log in.
403 Forbidden	The server understands but refuses the request.	A new login does not necessarily help.
404 Not Found	There is no such resource (or the server does not reveal it).	Check the address.
405 Method Not Allowed	The method is not allowed on the resource.	Use another method.
406 Not Acceptable	There is no variant matching the client's needs.	Ask for another Accept value.
409 Conflict	The request conflicts with the state of the resource.	Resolve the conflict.
415 Unsupported Media Type	The server does not support the sent format.	Send another Content-Type.
429 Too Many Requests	Too many requests arrived (rate limiting).	Wait; the Retry-After header can say how long.

The name 401 is misleading, because it typically means an authentication error (we do not know who you are), while 403 is an authorization error (we know who you are, but it is not allowed). According to RFC 9110, a 401 response must contain the WWW-Authenticate header, which says what kind of authentication it expects. 429 was introduced by RFC 6585, not RFC 9110.

An example of a bad request:

$ curl -i -X POST http://localhost:8080/jelentkezesek -d 'nem json'
HTTP/1.1 400 Bad Request
...

An example of content negotiation (406) will come in the next lesson.

Service error: 5xx

Code	Meaning
500 Internal Server Error	The server ran into an unexpected error.
502 Bad Gateway	A gateway or proxy received an invalid response from the server behind it.
503 Service Unavailable	The server cannot serve the request at the moment (overload, maintenance).
504 Gateway Timeout	The gateway did not get a response in time from the server behind it.

The cause of 5xx errors is often not the machine that sent the response, but a system behind it. At the peak of an enrolment period the effect of 429, 503, and 504 on the student is similar ("it doesn't work"), but their technical meaning and the remedy differ (chapter 10 returns to this).

Worked example: what does the student see in Kurzuspont?

Situation	Status code	What happens?
Opens the current course	200	The browser displays the page.
Opens an old link that has moved	301 + 200	The browser follows the redirect.
Enrols in a course	201	The enrolment was created.
Is not logged in, yet would enrol	401	The interface asks for a login.
Would look at another student's enrolments	403	The system refuses.
The course is already full	409	The state conflicts with the request.
Typed a course code that does not exist	404	Not found.
Thousands arrive at the moment of opening	429 or 503	The system limits or is temporarily unreachable.

Important: the "course is full" situation can be handled by the server with a 200 page or with a 409. The second expresses more precisely that the request was not fulfilled.

Common misconceptions

Statement	Clarification
"A 404 proves there is no connection."	The server responded, the resource is just missing.
"A 200 is success in every respect."	It signals only the HTTP-level result.
"401 and 403 are the same."	One is an authentication, the other an authorization error.
"A 3xx is always an error."	It mostly means a further step or a cache decision.
"A 5xx is always the fault of the server that sent it."	A system behind it can also cause it (see 502, 504).

In brief

• A status code is a three-digit, standard signal of the HTTP-level result of the request; the first digit denotes a family.
• 2xx success, 3xx redirection, 4xx the request cannot be fulfilled, 5xx server-side error.
• With 301/302 the method may change, 307/308 preserve it.
• 401 signals authentication, 403 authorization.
• HTTP success is not the same as business success.

Review questions

1. What is the difference between 401 and 403?
2. When is it worth using 307 or 308 instead of 301/302?
3. What do 502 and 504 mean, and how do they differ from 500?
4. Why can it be misleading if a page that contains an error message gets a 200 code?

Learning resources

• HTTP response status codes (MDN) — the complete list of codes.
• HTTP Semantics, RFC 9110 — section 15 is the official description of the status codes.
• Additional HTTP Status Codes, RFC 6585 — among others, the definition of 429.