Cybersecurity glossary
What is an HTTP Status Code?
Learn what an HTTP status code is, how 1xx–5xx classes differ, which codes matter for APIs and security monitoring, and how misleading statuses create operational risk.
Definition
An HTTP status code is a three-digit number in an HTTP response that indicates whether a request succeeded, was redirected, failed due to a client error, or failed due to a server error—guiding clients, caches, and operators on what to do next.
Why status codes matter
Clients need a shared language for outcomes. Without reliable HTTP status codes, browsers mishandle redirects, caches store error pages, mobile apps retry unsafely, and on-call dashboards go blind.
Status codes are also a security signal. A WAF returning 403, an API returning 401, and a rate limiter returning 429 tell different stories—and attackers probe those differences to map defenses.
Status code classes
| Class | Meaning | Common examples |
|---|---|---|
| 1xx | Informational — request received, continuing | 100 Continue |
| 2xx | Success — request handled as expected | 200 OK, 201 Created, 204 No Content |
| 3xx | Redirection — further action needed | 301 Moved Permanently, 302 Found, 304 Not Modified |
| 4xx | Client error — fix the request | 400, 401, 403, 404, 409, 429 |
| 5xx | Server error — something failed upstream | 500, 502, 503, 504 |
How clients use status codes
Server finishes handling the request
Routing, auth, validation, and business logic produce an outcome.
A three-digit code is selected
Frameworks and apps map outcomes to the closest standard semantics.
Optional reason phrase and body add detail
Humans and APIs may get a message or JSON problem document.
Intermediaries react
Caches, CDNs, and browsers apply redirect, caching, or error behavior.
Client libraries branch
SDKs retry 503s, refresh tokens on 401, or surface 422 validation errors.
Observability aggregates codes
SLO burn alerts often key on 5xx rates and unexpected 4xx spikes.
Codes every API team should get right
401 Unauthorized
Missing or invalid credentials. Prompt re-authentication; do not confuse with permission failures.
403 Forbidden
Authenticated but not allowed. Keep messages consistent to avoid leaking object existence if that is a concern.
404 Not Found
Unknown route or resource. Sometimes used deliberately instead of 403 for sensitive IDs.
409 Conflict
State conflict—useful for concurrent updates and idempotency key reuse mismatches.
422 Unprocessable Content
Well-formed request that fails semantic validation—common in APIs (usage varies by style).
429 Too Many Requests
Quota exceeded. Pair with Retry-After and clear limit documentation.
Security and operations pitfalls
Success codes for failures
Returning 200 for every error breaks monitoring and client retry logic.
Verbose 500 bodies
Stack traces and SQL fragments in error pages help attackers—log details server-side instead.
Inconsistent account oracles
Login flows that return 401 vs 404 differently for usernames enable enumeration.
Misused redirects
Open redirects via 302 with untrusted Location values become phishing helpers.
Practical checklist
- Define a status-code policy for your API (especially 401/403/404/409/429/5xx).
- Never return 2xx for failed authentication or authorization.
- Include machine-readable error bodies without leaking secrets or stack traces.
- Emit Retry-After on 429 and temporary 503 responses when practical.
- Alert on rising 5xx and sudden 401/403/429 pattern changes.
- Ensure CDNs do not cache authenticated error or success responses incorrectly.
- Document idempotent retry behavior for each status class.
- Review login and password-reset responses for user-enumeration side channels.
The practical takeaway
An HTTP status code is the compact outcome signal of a request. Correct classes keep clients, caches, and operators aligned; incorrect ones hide outages and create security side channels.
Treat status codes as part of your public contract: be consistent, be precise, and keep sensitive details in logs—not in casual error pages.
Related security terms
HTTP Method
The request action that a status code reports the outcome of.
Rate Limiting
Often signaled to clients with 429 Too Many Requests.
Broken Authentication
Where incorrect 401/403 handling can leak account existence or confuse clients.
Web Application Firewall (WAF)
Edge controls that may emit 403/406/429-style responses for blocked traffic.
Idempotency
Clients use status codes plus idempotency keys to decide whether to retry safely.
Frequently asked questions
What is an HTTP status code in simple terms?
It is a short number the server sends back to say how the request went—success, redirect, your mistake, or the server’s mistake.
What do the first digits mean?
1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error.
What is the difference between 401 and 403?
401 means authentication is missing or invalid. 403 means the server understood the client but refuses access—often authorization failure after authentication.
Should APIs always return 200 with errors in the body?
Prefer standard status codes so clients, proxies, and monitors can react correctly. Bodies can add detail, but do not hide failures behind 200.
What is 429?
Too Many Requests—used when rate limits or quotas are exceeded. Include Retry-After when you can.
Is 404 always “does not exist”?
It means the target resource was not found for that request. Some apps also use 404 to avoid confirming that a sensitive ID exists.
Why do status codes matter for security?
They drive retries, caching, monitoring alerts, and sometimes information disclosure if they reveal account or resource existence inconsistently.
References
Explore authoritative guidance and frameworks related to http status code.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.