Requests, responses and what a status code means
Every exchange is a method, a path and headers one way, and a status and headers back.
The shape of an exchange
A request is a method, a path, some headers and sometimes a body. A response is a status code, some headers and usually a body. Everything else — cookies, caching, authentication — is built out of those headers rather than added to the protocol.
The methods carry meaning the protocol expects you to honour. GET reads and must not change anything; POST creates or submits; PUT replaces; DELETE removes. Nothing enforces this, and a GET that changes data is a real bug rather than a style preference: browsers, caches and crawlers all assume GET is safe to repeat, and one of them will repeat it.
Status codes by their first digit
The first digit is the category, and it is worth knowing on its own: 2xx worked, 3xx go elsewhere, 4xx the request was wrong, 5xx the server was wrong. Getting that far tells you who has the problem.
A few are worth knowing exactly. 301 is a permanent redirect and browsers cache it hard — get one wrong in production and visitors keep following it long after you have fixed the server. 302 and 307 are temporary. 404 means nothing is there; 410 means it was there and is deliberately gone. 401 means you are not authenticated; 403 means you are, and still may not.
429 means you are being rate limited, and it usually comes with a Retry-After header saying when to come back. Honouring it is the difference between a client that recovers and one that makes the problem worse.
Worked examples
A request that must not change anything
/GET /v1/news HTTP/2/Against:
Safe to repeat, cache and prefetchAnything that changes state behind a GET will eventually be triggered by a crawler or a cache.
Check yourself
Practice questions written for this lesson — not past exam papers.
Practise every question in this subject
What does a 4xx status tell you?
Why is a GET that changes data a bug?