HTTP and HTTPS — Requests and Status Codes
Every call to notes-api is an HTTP conversation: a browser, a phone app or another service sends a request and gets a response. When something fails, the response's three-digit status code usually tells you whose fault it is before you read any logs.
The rule
A request is a method, a path and headers; the first status digit names the culprit.
A request says what to do (method), to what (path), plus headers and sometimes a body:
POST /notes HTTP/1.1
Host: notes.example.com
Content-Type: application/json
{"title": "Buy milk"}Common methods: GET reads, POST creates, PUT replaces, PATCH changes part, DELETE removes. GET should never change data.
The response starts with a status code:
| Class | Meaning | Common codes |
|---|---|---|
| 2xx | success | 200 OK, 201 Created, 204 No Content |
| 3xx | go elsewhere | 301 moved permanently, 302 temporarily, 304 not modified |
| 4xx | the client got something wrong | 400 bad request, 401 not authenticated, 403 forbidden, 404 not found, 429 too many requests |
| 5xx | the server failed | 500 error, 502 bad gateway, 503 unavailable, 504 gateway timeout |
401 means "I do not know who you are"; 403 means "I know who you are, and the answer is no". 502 and 504 come from a proxy such as nginx: the app behind it gave a bad reply or none in time.
HTTPS is the same HTTP carried inside an encrypted TLS connection. Plain HTTP usually uses port 80; HTTPS uses port 443.
curl -i https://notes.example.com/notes/42 # show status and headers
curl -v https://notes.example.com/health # also show the connection and TLSThe shortcut
Read the first digit, then the rest. 2 means fine, 3 means follow the redirect, 4 means fix the request, 5 means look at the server. Only then look up the exact code.
404 on /note/42
4xx: the client asked for something wrong. The real path is
/notes/42.
Drills
Answer fast — trust the rule.
A request returns 503. Whose side is the problem on?
A logged-in user gets a response saying they are not allowed to see a page. Which code fits?
nginx returns 502 Bad Gateway. What does it most likely mean?
Which HTTP method is meant to read data without changing it?
What is the practical difference between HTTP and HTTPS?
Remember
- A request is a method, a path and headers; the first status digit names the culprit.
- Shortcut: 2 fine, 3 redirect, 4 fix the request, 5 look at the server.
- Trap: mixing up 401 (who are you?) and 403 (not allowed).