HTTP Status Codes

HTTP/1.1 100 Continue

HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade

HTTP/1.1 102 Processing

HTTP/1.1 103 Early Hints
Link: </style.css>; rel=preload; as=style
Link: </script.js>; rel=preload; as=script

HTTP/1.1 200 OK
Content-Type: application/json
 
{
 "message": "Success banget!"
}

HTTP/1.1 201 Created
Location: /api/users/123
Content-Type: application/json
 
{
 "id": 123,
 "name": "Budi"
}

HTTP/1.1 202 Accepted
Content-Type: application/json
 
{
 "job_id": "abc123",
 "status": "processing"
}

HTTP/1.1 203 Non-Authoritative Information

HTTP/1.1 204 No Content

HTTP/1.1 205 Reset Content

HTTP/1.1 206 Partial Content
Content-Range: bytes 0-1023/10240
Content-Length: 1024
 
[partial data...]

HTTP/1.1 207 Multi-Status
Content-Type: application/xml
 
<?xml version="1.0"?>
<multistatus xmlns="DAV:">
 <response>...</response>
</multistatus>

HTTP/1.1 208 Already Reported

HTTP/1.1 226 IM Used
IM: vcdiff

HTTP/1.1 300 Multiple Choices
Content-Type: text/html
 
<ul>
 <li><a href="/doc.html">HTML version</a></li>
 <li><a href="/doc.pdf">PDF version</a></li>
</ul>

HTTP/1.1 301 Moved Permanently
Location: https://new-domain.com/page

// Express.js
app.get('/old-page', (req, res) => {
 res.redirect(301, '/new-page');
});

HTTP/1.1 302 Found
Location: /temporary-page

HTTP/1.1 303 See Other
Location: /success-page

// After form submission
app.post('/submit', (req, res) => {
 // Process form...
 res.redirect(303, '/success');
});

HTTP/1.1 304 Not Modified
ETag: "abc123"
Cache-Control: max-age=3600

HTTP/1.1 307 Temporary Redirect
Location: /temp-location

HTTP/1.1 308 Permanent Redirect
Location: /new-permanent-location

HTTP/1.1 400 Bad Request
Content-Type: application/json
 
{
 "error": "Invalid JSON syntax"
}

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api"
 
{
 "error": "Token expired"
}

// JWT authentication
if (!token || !isValidToken(token)) {
 return res.status(401).json({
  error: 'Authentication required'
 });
}

HTTP/1.1 402 Payment Required

HTTP/1.1 403 Forbidden
 
{
 "error": "You don't have permission to access this resource"
}

// Kamu udah login, tapi bukan admin
if (!user.isAdmin) {
 return res.status(403).json({
  error: 'Admin only'
 });
}

HTTP/1.1 404 Not Found
 
{
 "error": "Resource not found"
}

app.use((req, res) => {
 res.status(404).json({
  error: 'Endpoint not found',
  path: req.path
 });
});

HTTP/1.1 405 Method Not Allowed
Allow: GET, POST
 
{
 "error": "DELETE method not allowed"
}

HTTP/1.1 406 Not Acceptable

HTTP/1.1 407 Proxy Authentication Required
Proxy-Authenticate: Basic realm="proxy"

HTTP/1.1 408 Request Timeout

HTTP/1.1 409 Conflict
 
{
 "error": "Email already exists"
}

// Email udah dipake
if (await User.findOne({ email })) {
 return res.status(409).json({
  error: 'Email already registered'
 });
}

HTTP/1.1 410 Gone
 
{
 "error": "This resource has been permanently deleted"
}

HTTP/1.1 411 Length Required

HTTP/1.1 412 Precondition Failed

HTTP/1.1 413 Payload Too Large
 
{
 "error": "File size exceeds 10MB limit"
}

app.use(express.json({ limit: '10mb' }));

HTTP/1.1 414 URI Too Long

HTTP/1.1 415 Unsupported Media Type
 
{
 "error": "Only JSON is supported",
 "received": "application/xml"
}

HTTP/1.1 416 Range Not Satisfiable
Content-Range: bytes */10240

HTTP/1.1 417 Expectation Failed

HTTP/1.1 418 I'm a teapot
 
{
 "error": "I'm a teapot, not a coffee maker! ☕"
}

HTTP/1.1 421 Misdirected Request

HTTP/1.1 422 Unprocessable Entity
 
{
 "errors": {
  "email": "Invalid email format",
  "age": "Must be at least 18"
 }
}

// Validation error
const errors = validateUser(req.body);
if (errors.length > 0) {
 return res.status(422).json({ errors });
}

HTTP/1.1 423 Locked

HTTP/1.1 424 Failed Dependency

HTTP/1.1 425 Too Early

HTTP/1.1 426 Upgrade Required
Upgrade: HTTP/2.0

HTTP/1.1 428 Precondition Required

HTTP/1.1 429 Too Many Requests
Retry-After: 3600
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1640000000
 
{
 "error": "Rate limit exceeded. Try again in 1 hour"
}

// Rate limiting middleware
const rateLimit = require('express-rate-limit');
 
const limiter = rateLimit({
 windowMs: 15 * 60 * 1000, // 15 menit
 max: 100, // max 100 requests
 message: 'Too many requests',
 standardHeaders: true,
 legacyHeaders: false,
});
 
app.use('/api/', limiter);

HTTP/1.1 431 Request Header Fields Too Large

HTTP/1.1 451 Unavailable For Legal Reasons
 
{
 "error": "Content blocked due to legal reasons"
}

HTTP/1.1 500 Internal Server Error
 
{
 "error": "Something went wrong on our end"
}

app.use((err, req, res, next) => {
 console.error(err.stack); // Log di server
 res.status(500).json({
  error: 'Internal server error'
  // Jangan: error: err.message (bisa expose sensitive info)
 });
});

HTTP/1.1 501 Not Implemented
 
{
 "error": "This method is not supported yet"
}

HTTP/1.1 502 Bad Gateway

HTTP/1.1 503 Service Unavailable
Retry-After: 3600
 
{
 "error": "Service temporarily unavailable",
 "retry_after": 3600
}

const MAINTENANCE_MODE = process.env.MAINTENANCE === 'true';
 
app.use((req, res, next) => {
 if (MAINTENANCE_MODE) {
  return res.status(503).json({
   error: 'Under maintenance',
   message: 'We will be back soon!'
  });
 }
 next();
});

HTTP/1.1 504 Gateway Timeout

HTTP/1.1 505 HTTP Version Not Supported

HTTP/1.1 506 Variant Also Negotiates

HTTP/1.1 507 Insufficient Storage

HTTP/1.1 508 Loop Detected

HTTP/1.1 510 Not Extended

HTTP/1.1 511 Network Authentication Required
 
{
 "error": "Network authentication required"
}

200 OK         → Request sukses
201 Created      → Resource dibuat
202 Accepted      → Async processing
204 No Content     → Sukses tapi gak ada data
206 Partial Content  → Partial data (streaming)

301 Moved Permanently   → Permanent redirect
302 Found         → Temporary redirect (method bisa berubah)
303 See Other      → POST-Redirect-GET
304 Not Modified     → Use cache
307 Temporary Redirect  → Temporary (method tetap)
308 Permanent Redirect  → Permanent (method tetap)

400 Bad Request       → Syntax/validation error
401 Unauthorized       → Gak authenticated
403 Forbidden        → Gak authorized
404 Not Found        → Resource gak ada
409 Conflict        → Duplicate/conflict
422 Unprocessable Entity  → Semantic validation error
429 Too Many Requests    → Rate limit exceeded

500 Internal Server Error  → Generic server error
502 Bad Gateway      → Invalid upstream response
503 Service Unavailable  → Temporary unavailable
504 Gateway Timeout    → Upstream timeout

// GET - Retrieve data
app.get('/users/:id', async (req, res) => {
 const user = await User.findById(req.params.id);
 if (!user) return res.status(404).json({ error: 'User not found' });
 res.status(200).json(user);
});
 
// POST - Create resource
app.post('/users', async (req, res) => {
 const user = await User.create(req.body);
 res.status(201)
   .location(`/users/${user.id}`)
   .json(user);
});
 
// PUT - Update (full replacement)
app.put('/users/:id', async (req, res) => {
 const user = await User.findByIdAndUpdate(req.params.id, req.body);
 if (!user) return res.status(404).json({ error: 'User not found' });
 res.status(200).json(user);
});
 
// PATCH - Partial update
app.patch('/users/:id', async (req, res) => {
 const user = await User.findByIdAndUpdate(
  req.params.id,
  { $set: req.body },
  { new: true }
 );
 if (!user) return res.status(404).json({ error: 'User not found' });
 res.status(200).json(user);
});
 
// DELETE - Delete resource
app.delete('/users/:id', async (req, res) => {
 const user = await User.findByIdAndDelete(req.params.id);
 if (!user) return res.status(404).json({ error: 'User not found' });
 res.status(204).send();
});

// Error response standard
{
 "error": {
  "code": "VALIDATION_ERROR",
  "message": "Validation failed",
  "details": [
   {
    "field": "email",
    "message": "Invalid email format"
   }
  ]
 }
}
 
// Implementation
class APIError extends Error {
 constructor(statusCode, code, message, details = []) {
  super(message);
  this.statusCode = statusCode;
  this.code = code;
  this.details = details;
 }
}
 
// Usage
app.post('/register', (req, res, next) => {
 const errors = validateUser(req.body);
 if (errors.length) {
  return next(new APIError(
   422,
   'VALIDATION_ERROR',
   'Validation failed',
   errors
  ));
 }
 // Process registration...
});
 
// Error handler
app.use((err, req, res, next) => {
 const statusCode = err.statusCode || 500;
 res.status(statusCode).json({
  error: {
   code: err.code || 'INTERNAL_ERROR',
   message: err.message,
   details: err.details || []
  }
 });
});

// 401 - Unauthenticated (belum login)
if (!req.user) {
 return res.status(401).json({
  error: 'Authentication required',
  message: 'Please login first'
 });
}
 
// 403 - Unauthorized (udah login tapi gak boleh)
if (req.user.role !== 'admin') {
 return res.status(403).json({
  error: 'Forbidden',
  message: 'Admin access required'
 });
}

// 304 Not Modified pattern
app.get('/data', (req, res) => {
 const data = getData();
 const etag = generateETag(data);
 
 // Check if client has latest version
 if (req.headers['if-none-match'] === etag) {
  return res.status(304).end();
 }
 
 res.set('ETag', etag)
   .set('Cache-Control', 'max-age=3600')
   .json(data);
});

// 429 Too Many Requests
const rateLimit = new Map();
 
function checkRateLimit(userId) {
 const now = Date.now();
 const userLimit = rateLimit.get(userId) || { count: 0, resetTime: now + 60000 };
 
 if (now > userLimit.resetTime) {
  userLimit.count = 0;
  userLimit.resetTime = now + 60000;
 }
 
 userLimit.count++;
 rateLimit.set(userId, userLimit);
 
 return {
  allowed: userLimit.count <= 100,
  remaining: Math.max(0, 100 - userLimit.count),
  resetTime: userLimit.resetTime
 };
}
 
app.use((req, res, next) => {
 const limit = checkRateLimit(req.user?.id || req.ip);
 
 res.set({
  'X-RateLimit-Limit': '100',
  'X-RateLimit-Remaining': limit.remaining.toString(),
  'X-RateLimit-Reset': Math.floor(limit.resetTime / 1000).toString()
 });
 
 if (!limit.allowed) {
  return res.status(429).json({
   error: 'Too many requests',
   retry_after: Math.ceil((limit.resetTime - Date.now()) / 1000)
  });
 }
 
 next();
});

// JANGAN GINI!
app.post('/users', async (req, res) => {
 try {
  const user = await User.create(req.body);
  res.status(200).json(user); // Harusnya 201
 } catch (err) {
  res.status(200).json({ error: err.message }); // Harusnya 4xx/5xx
 }
});

app.post('/users', async (req, res) => {
 try {
  const user = await User.create(req.body);
  res.status(201)
    .location(`/users/${user.id}`)
    .json(user);
 } catch (err) {
  if (err.code === 11000) { // Duplicate key
   return res.status(409).json({ error: 'User already exists' });
  }
  res.status(500).json({ error: 'Internal server error' });
 }
});

// SALAH!
if (!user.isAdmin) {
 return res.status(401).json({ error: 'Not admin' }); // Harusnya 403
}

// Authentication (401)
if (!req.user) {
 return res.status(401).json({ error: 'Please login' });
}
 
// Authorization (403)
if (!req.user.isAdmin) {
 return res.status(403).json({ error: 'Admin only' });
}

// BAHAYA! Jangan expose stack trace
app.use((err, req, res, next) => {
 res.status(500).json({
  error: err.message,
  stack: err.stack // JANGAN!
 });
});

app.use((err, req, res, next) => {
 // Log di server
 console.error(err);
 
 // Return generic message
 res.status(500).json({
  error: 'Internal server error'
 });
});

Request diterima
  ↓
Syntax valid?
  ├─ No → 400 Bad Request
  └─ Yes
    ↓
  Authenticated?
    ├─ No → 401 Unauthorized
    └─ Yes
      ↓
    Authorized?
      ├─ No → 403 Forbidden
      └─ Yes
        ↓
      Resource exists?
        ├─ No → 404 Not Found
        └─ Yes
          ↓
        Method allowed?
          ├─ No → 405 Method Not Allowed
          └─ Yes
            ↓
          Validation passed?
            ├─ No → 422 Unprocessable Entity
            └─ Yes
              ↓
            Processing successful?
              ├─ No → 500 Internal Server Error
              └─ Yes
                ↓
              Action?
                ├─ Create → 201 Created
                ├─ Delete → 204 No Content
                ├─ Update → 200 OK
                └─ Read → 200 OK

describe('User API', () => {
 test('POST /users - should return 201 on success', async () => {
  const res = await request(app)
   .post('/users')
   .send({ name: 'Budi', email: 'budi@example.com' });
 
  expect(res.status).toBe(201);
  expect(res.body).toHaveProperty('id');
  expect(res.headers.location).toBeDefined();
 });
 
 test('POST /users - should return 409 on duplicate', async () => {
  const userData = { name: 'Budi', email: 'budi@example.com' };
 
  // Create first user
  await request(app).post('/users').send(userData);
 
  // Try to create duplicate
  const res = await request(app).post('/users').send(userData);
 
  expect(res.status).toBe(409);
  expect(res.body.error).toContain('already exists');
 });
 
 test('GET /users/:id - should return 404 for non-existent user', async () => {
  const res = await request(app).get('/users/999999');
 
  expect(res.status).toBe(404);
  expect(res.body.error).toBeDefined();
 });
 
 test('DELETE /users/:id - should return 204 on success', async () => {
  const user = await User.create({ name: 'Budi' });
  const res = await request(app).delete(`/users/${user.id}`);
 
  expect(res.status).toBe(204);
  expect(res.body).toEqual({});
 });
});

describe('Error handling', () => {
 test('should return 401 when not authenticated', async () => {
  const res = await request(app)
   .get('/api/protected')
   .set('Authorization', ''); // No token
 
  expect(res.status).toBe(401);
 });
 
 test('should return 403 when not authorized', async () => {
  const token = generateToken({ role: 'user' });
  const res = await request(app)
   .get('/api/admin-only')
   .set('Authorization', `Bearer ${token}`);
 
  expect(res.status).toBe(403);
 });
 
 test('should return 429 when rate limited', async () => {
  // Make 101 requests
  for (let i = 0; i < 101; i++) {
   await request(app).get('/api/data');
  }
 
  const res = await request(app).get('/api/data');
  expect(res.status).toBe(429);
  expect(res.headers['retry-after']).toBeDefined();
 });
});