The Application Layer & HTTP

an HTTP status code

When you ask a librarian for a book, they answer not just with the book but with a tone: "here you go" (success), "it moved to the next floor" (look elsewhere), "we don't have that" (not found), or "sorry, the lights just blew" (our fault). An HTTP status code is exactly that one-line verdict the server stamps on every response: a three-digit number telling the client how the request turned out before it even looks at the body.

The codes are grouped by their first digit, which is the whole trick to reading them. 1xx is informational (rarely seen). 2xx means success — 200 OK is the everyday "here is what you asked for." 3xx means redirection — 301 Moved Permanently says "this resource now lives at a new URL; go there instead," and the browser usually follows automatically. 4xx means the client made a mistake — 404 Not Found means there is nothing at that URL, 403 Forbidden means you are not allowed, 400 means your request was malformed. 5xx means the server failed — 500 Internal Server Error means the server's own code crashed or broke while handling a perfectly valid request.

The split between 4xx and 5xx is the most important thing to internalise: 4xx is "you (the client) got it wrong," 5xx is "I (the server) got it wrong." A 404 is not a server failure — the server worked fine and correctly told you the page does not exist. This distinction drives real decisions: caches, monitoring dashboards, and retry logic all behave differently for a 404 (do not retry, it will keep not existing) versus a 503 Service Unavailable (maybe retry shortly, the server is just overloaded right now).

You click an old bookmark. The server replies 301 with a Location header pointing at the new URL; your browser quietly re-requests that and gets 200. If the page were truly gone, you would get 404. If the site's database had crashed, you would get 500 even though your request was perfectly valid.

First digit tells the story: 2 success, 3 go elsewhere, 4 your mistake, 5 the server's mistake.

A 200 only means the HTTP request succeeded, not that the operation you wanted worked. An API can return 200 with a body that says "login failed" — sloppy design, but legal. Always read the body, not just the code.

Also called
response code狀態碼HTTP 回應碼