Search, compare, and troubleshoot all RFC 9110 HTTP status codes with debugging steps and response examples.
Common Dilemmas:
200
OK
Standard response for successful HTTP requests.
201
Created
Request succeeded and a new resource was created.
204
No Content
Request succeeded, but there is no payload body to return.
301
Moved Permanently
Target resource has been assigned a new permanent URI.
302
Found (Temporary Redirect)
Target resource resides temporarily under a different URI.
304
Not Modified
Client conditional GET/HEAD request was checked against ETag/Last-Modified and has not changed.
307
Temporary Redirect (Strict Method)
Resource is temporarily at another URI; client MUST NOT change the HTTP method.
308
Permanent Redirect (Strict Method)
Resource permanently moved; client MUST NOT change the HTTP method.
400
Bad Request
Server cannot or will not process request due to client error (malformed syntax, invalid framing).
401
Unauthorized (Unauthenticated)
Request lacks valid authentication credentials for the target resource.
403
Forbidden
Server understood the request and identity, but refuses to authorize it.
404
Not Found
Origin server cannot find a current representation for the target resource.
409
Conflict
Request cannot be completed due to a conflict with current resource state.
422
Unprocessable Entity
Syntax is valid JSON, but semantic validation failed (e.g. age < 0, invalid email format).
429
Too Many Requests
User has sent too many requests in a given amount of time (Rate Limited).
500
Internal Server Error
Server encountered an unexpected condition that prevented it from fulfilling the request.
502
Bad Gateway
Server acting as gateway/proxy received an invalid or crashed response from upstream server.
503
Service Unavailable
Server is currently unable to handle request due to temporary overload or scheduled maintenance.
504
Gateway Timeout
Proxy/Gateway did not receive timely response from upstream server (Request Timed Out).
502
Bad Gateway
RFC 9110 §15.6.3 · ❌ Non-cacheable
When to Return This Status Code
Reverse proxy (Nginx, Cloudflare, AWS ALB) cannot communicate with downstream app server (Node/Go/Python).
Common Production Causes & Fixes
Verify upstream backend process is running (`systemctl status` or `pm2 status`)
Check Nginx `error.log` for `Connection refused` or `Connection reset by peer`
Example HTTP Wire Response
HTTP/1.1 502 Bad Gateway
Server: nginx/1.24.0
Content-Type: text/html
<html><body>502 Bad Gateway</body></html>
The Complete Guide to HTTP Status Codes & Error Troubleshooting
HTTP status codes are standardized 3-digit integers defined by the Internet Engineering Task Force (IETF) in RFC 9110 (which obsoleted RFC 7231 and RFC 2616). They communicate the outcome of a client's request to the server, guiding browser caching, redirect handling, and automated retry mechanisms.
Key Differences Between Frequently Confused Status Codes
401 Unauthorized vs 403 Forbidden:401 means the user is unauthenticated (missing or invalid credentials/token); 403 means the server knows who the user is, but their role or IP lacks permission to access the resource.
301 Moved Permanently vs 308 Permanent Redirect:301 allows clients to historically change HTTP POST/PUT verbs to GET upon redirect; 308 guarantees that the HTTP verb and body payload remain strictly preserved.
502 Bad Gateway vs 504 Gateway Timeout:502 indicates that the reverse proxy (e.g. Nginx or Cloudflare) connected to the backend server (Node.js/Python), but received an immediate crash, closed connection, or invalid TCP response; 504 indicates the proxy connected, but the backend took longer than the configured timeout threshold (e.g. 60 seconds) to return any data.
Best Practices for REST APIs
Avoid returning 200 OK with an error message inside the JSON body. Use proper semantic 4xx and 5xx codes, and adopt the standard RFC 7807 Problem Details for HTTP APIs (application/problem+json) format to communicate human-readable error titles and machine-parsable error types.