The Complete Guide to HTTP Status Codes & Error Troubleshooting
HTTP status codes are standardized 3-digit integers defined by the Internet Engineering Task Force (IETF) in RFC 9110 (which obsoleted RFC 7231 and RFC 2616). They communicate the outcome of a client's request to the server, guiding browser caching, redirect handling, and automated retry mechanisms.
Key Differences Between Frequently Confused Status Codes
- 401 Unauthorized vs 403 Forbidden:
401means the user is unauthenticated (missing or invalid credentials/token);403means the server knows who the user is, but their role or IP lacks permission to access the resource. - 301 Moved Permanently vs 308 Permanent Redirect:
301allows clients to historically change HTTP POST/PUT verbs to GET upon redirect;308guarantees that the HTTP verb and body payload remain strictly preserved. - 502 Bad Gateway vs 504 Gateway Timeout:
502indicates that the reverse proxy (e.g. Nginx or Cloudflare) connected to the backend server (Node.js/Python), but received an immediate crash, closed connection, or invalid TCP response;504indicates the proxy connected, but the backend took longer than the configured timeout threshold (e.g. 60 seconds) to return any data.
What RFC 9110 Officially Says About 502 Bad Gateway
The 502 status code is formally defined in RFC 9110 ยง15.6.3, the current IETF standard for HTTP semantics (it obsoletes RFC 7231, which defined the same wording under ยง6.6.3). The official text reads:
"The 502 (Bad Gateway) status code indicates that the server, while acting as a gateway or proxy, received an invalid response from an inbound server it accessed while attempting to fulfill the request."
In practice, that "inbound server" is your actual application process (Node, Python, Go, Java) sitting behind a reverse proxy or load balancer (Nginx, Cloudflare, AWS ALB). The proxy successfully made a connection, but got back something it couldn't parse as a valid HTTP response โ most commonly because the upstream process crashed mid-request, closed the TCP connection unexpectedly, or returned malformed headers. This is distinct from a 504, where the proxy never got a response at all within its timeout window.
Best Practices for REST APIs
Avoid returning 200 OK with an error message inside the JSON body. Use proper semantic 4xx and 5xx codes, and adopt the standard RFC 7807 Problem Details for HTTP APIs (application/problem+json) format to communicate human-readable error titles and machine-parsable error types.