HTTP Status Codes: Explained all

HTTP status codes play a vital role in web communication, indicating the outcome of a request between a client (like a web browser) and a server. Understanding these status codes is crucial for both developers and everyday internet users.

Know more about HTTP Requests and Response

The Basics:

HTTP stands for Hypertext Transfer Protocol and status codes are three-digit numbers returned by servers to indicate the outcome of a request. Each status code falls into one of five categories, represented by the first digit.

2xx Success:

The 2xx status codes indicate that the client’s request was successful. While hackers generally cannot exploit these codes directly, they might use them as a starting point to launch subsequent attacks. For example:

200 OK: Hackers might analyze the content returned by the server (e.g., website source code) for vulnerabilities or sensitive information that can be used in further attacks.

3xx Redirection:

The 3xx status codes inform the client that additional action needs to be taken to fulfill the request. Although not inherently exploitable, hackers can abuse them for malicious purposes. Examples include:

301 Moved Permanently: Hackers can redirect legitimate user traffic to malicious websites by modifying the URL of a trusted site using this code.
302 Found: By manipulating the temporary redirect, hackers can trick users into visiting malicious websites or phishing pages.

4xx Client Errors:

The 4xx status codes indicate that there was an error with the client’s request. Hackers can take advantage of these errors to gain unauthorized access or disrupt services. Examples include:

404 Not Found: Hackers can craft malicious requests or manipulate URLs to trigger 404 errors, attempting to discover hidden files or vulnerable areas on a website.
403 Forbidden: Through various techniques like directory traversal attacks, hackers attempt to bypass access restrictions and gain unauthorized access to restricted resources.

5xx Server Errors:

The 5xx status codes suggest that there was an error on the server’s side while processing the request. Although not directly exploitable, hackers can use these errors to launch attacks that exploit server weaknesses. Examples include:

500 Internal Server Error: By intentionally causing server errors, hackers might expose sensitive error messages, revealing server configurations or vulnerabilities.
503 Service Unavailable: Hackers can perform distributed denial-of-service (DDoS) attacks to overwhelm servers, causing them to return this status code and rendering websites or services inaccessible.

Status Codes: Cheat Sheet

Status Code	Description	Use Case
100	Continue	The server has received the request headers and the client should proceed to send the request body.
101	Switching Protocols	The server is switching protocols according to the client’s request.
200	OK	The request has succeeded.
201	Created	The request has been fulfilled, and a new resource has been created.
202	Accepted	The request has been accepted for processing, but the processing has not been completed.
204	No Content	The server has fulfilled the request, but there is no content to send back.
300	Multiple Choices	The requested resource has multiple choices, each with its own specific location.
301	Moved Permanently	The requested resource has been permanently moved to a new location.
302	Found	The requested resource has been temporarily moved to a different location.
304	Not Modified	The client’s cached version of the requested resource is still valid and can be used.
400	Bad Request	The server cannot understand the request due to malformed syntax or invalid parameters.
401	Unauthorized	The request requires user authentication.
403	Forbidden	The server understood the request but refuses to authorize it.
404	Not Found	The requested resource could not be found on the server.
405	Method Not Allowed	The method specified in the request is not allowed for the specified resource.
406	Not Acceptable	The server cannot produce a response matching the list of acceptable values defined by the client.
408	Request Timeout	The server timed out waiting for the request from the client.
410	Gone	The requested resource is no longer available and has been permanently removed.
500	Internal Server Error	A generic error message indicating a problem on the server.
501	Not Implemented	The server does not support the functionality required to fulfill the request.
502	Bad Gateway	The server received an invalid response from an upstream server.
503	Service Unavailable	The server is currently unable to handle the request due to maintenance or high load.
504	Gateway Timeout	The server did not receive a timely response from an upstream server.
505	HTTP Version Not Supported	The server does not support the HTTP protocol version used in the request.