When should I use HTTP 301 vs HTTP 302 vs HTTP 307/308?

Use 301 Moved Permanently for permanent SEO URL migrations. Use 302 Found for temporary legacy redirects. However, 301 and 302 historically allowed browsers to incorrectly change POST requests to GET. For modern APIs, use 307 (Temporary) or 308 (Permanent) because they strictly guarantee the HTTP request method remains unchanged.

Why do I see a 502 Bad Gateway error behind Nginx or Cloudflare?

A 502 error occurs when a reverse proxy (like Cloudflare, Nginx, or AWS ALB) receives an invalid response or connection drop from the upstream application server (like Node.js, Python, or Go). Common causes include crashed backend services, port mismatches, or internal socket timeouts.

Which HTTP status codes are cacheable by default?

According to RFC 9110, responses with status codes 200 (OK), 203 (Non-Authoritative Info), 204 (No Content), 206 (Partial Content), 300 (Multiple Choices), 301 (Moved Permanently), 404 (Not Found), 405 (Method Not Allowed), 410 (Gone), 414 (URI Too Long), and 501 (Not Implemented) can be cached unless explicit Cache-Control headers prevent it.

HTTP Status Code Diagnostic Explorer

Quick-reference directory for all 1xx-5xx HTTP response codes. Diagnostic blueprints, cacheability, root causes, and fix checklists.

Showing 69 of 69 HTTP codes

Common Confusion Guides

401 vs 403 (Unauthenticated vs Unauthorized)401 · 403

401 Unauthorized means 'Who are you?' (Missing or invalid credentials). 403 Forbidden means 'I know who you are, but you do not have permission' (Insufficient role/permissions).

301 vs 302 vs 308 (Redirect Semantics)301 · 308

301 Moved Permanently is cached permanently by browsers and search engines, but historically rewrote POST into GET. 308 Permanent Redirect preserves the original POST/PUT method and body payload.

502 vs 504 (Gateway Crash vs Gateway Timeout)502 · 504

502 Bad Gateway means the upstream server refused connection or immediately crashed. 504 Gateway Timeout means the upstream accepted connection but took too long to answer before timing out.

400 vs 422 (Syntax Malformed vs Semantic Failure)400 · 422

400 Bad Request indicates malformed request syntax (e.g. invalid JSON syntax). 422 Unprocessable Content means the JSON syntax is valid, but internal business logic validation failed (e.g. negative age).

404 vs 410 (Missing vs Permanently Purged)404 · 410

404 Not Found means the resource is absent right now, but might return. 410 Gone explicitly tells search engines and clients that the resource was permanently purged and should be de-indexed immediately.

521 vs 522 vs 524 (Cloudflare Server Failures)521 · 524

521 means origin server is down or refused connection. 522 means TCP handshake timed out (firewall/routing). 524 means connection succeeded, but origin took over 100 seconds to generate the HTTP response.

100

Continue

The initial part of the request has been received and the client should proceed with sending the request body.

1xx

101

Switching Protocols

The requester has asked the server to switch protocols (such as upgrading to WebSocket) and the server agrees.

1xx

102

ProcessingWebDAV

An informational code indicating that the server has accepted the complete request, but has not yet completed it.

1xx

103

Early Hints

Used to return Link headers before the final response, allowing browsers to preload critical CSS/JS assets.

1xx

200

Standard response for successful HTTP requests. The payload depends on the request method.

2xx

201

Created

The request has succeeded and led to the creation of a new resource (typically with a Location header).

2xx

202

Accepted

The request has been accepted for processing, but the processing has not been completed.

2xx

203

Non-Authoritative Information

The request was successful but the enclosed payload was modified from the origin server's 200 response by a transforming proxy.

2xx

204

No Content

The server successfully fulfilled the request, and there is no additional content to send in the response payload.

2xx

205

Reset Content

Tells the user agent to reset the document view which sent the request (e.g. clear form fields after submission).

2xx

206

Partial Content

The server is delivering only part of the resource due to a Range header sent by the client.

2xx

207

Multi-StatusWebDAV

Conveys information about multiple resources in situations where multiple status codes might be appropriate.

2xx

208

Already ReportedWebDAV

Used inside a WebDAV Multi-Status response to avoid repeatedly enumerating the internal members of multiple bindings.

2xx

226

IM Used

The server has fulfilled a GET request for the resource, and the response is a representation of the result of one or more instance-manipulations.

2xx

300

Multiple Choices

The request has more than one possible response. The user agent or user should choose one of them.

3xx

301

Moved Permanently

The target resource has been assigned a new permanent URI. Search engines transfer ranking and PageRank.

3xx

302

Found (Temporary Redirect)

The target resource resides temporarily under a different URI. Search engines keep old URL indexed.

3xx

303

See Other

The server is redirecting the user agent to a different resource (via GET), typically after a POST form submission.

3xx

304

Not Modified

Indicates the resource has not been modified since the version specified by conditional headers (If-None-Match).

3xx

307

Temporary Redirect

Temporary redirect that strictly guarantees the HTTP method (POST/PUT) is NOT changed when following.

3xx

308

Permanent Redirect

Permanent redirect that strictly guarantees the HTTP method (POST/PUT) is NOT changed when following.

3xx

400

Bad Request

The server cannot process the request due to perceived client error (malformed syntax, invalid framing).

4xx

401

Unauthorized

The request has not been applied because it lacks valid authentication credentials for the target resource.

4xx

402

Payment Required

Reserved for digital payment systems; widely adopted by modern SaaS APIs for depleted quota or unpaid invoices.

4xx

403

Forbidden

The server understood the request but refuses to authorize it. Unlike 401, the client identity is known.

4xx

404

Not Found

The origin server did not find a current representation for the target resource or is unwilling to disclose it.

4xx

405

Method Not Allowed

The request method is known by the server but is not supported by the target resource.

4xx

406

Not Acceptable

The resource cannot generate content matching the acceptable values defined in the request's Accept headers.

4xx

407

Proxy Authentication Required

Similar to 401, but the client must first authenticate itself with an intermediary proxy.

4xx

408

Request Timeout

The server did not receive a complete request message within the time that it was prepared to wait.

4xx

409

Conflict

The request could not be completed due to a conflict with the current state of the target resource.

4xx

410

Gone

The target resource is no longer available at the origin server and no forwarding address is known.

4xx

411

Length Required

The server refuses to accept the request without a defined Content-Length header.

4xx

412

Precondition Failed

One or more conditions given in the request header fields evaluated to false when tested on the server.

4xx

413

Payload Too Large

The request payload exceeds the maximum size capacity configured on the server or reverse proxy.

4xx

414

URI Too Long

The request URI is longer than the server is willing to interpret.

4xx

415

Unsupported Media Type

The server refuses to accept the request because the payload format is in an unsupported format.

4xx

416

Range Not Satisfiable

None of the ranges in the request's Range header field overlap the current extent of the selected resource.

4xx

417

Expectation Failed

The expectation given in the request's Expect header could not be met by at least one of the inbound servers.

4xx

418

I'm a teapot

Any attempt to brew coffee with a teapot should result in the error code '418 I'm a teapot'.

4xx

421

Misdirected Request

The request was directed at a server that is not able to produce a response (HTTP/2 connection reuse).

4xx

422

Unprocessable Content

The server understands the content type and syntax, but was unable to process the contained instructions.

4xx

423

LockedWebDAV

The resource that is being accessed is currently locked against modification.

4xx

424

Failed DependencyWebDAV

The method could not be performed because the requested action depended on another action that failed.

4xx

425

Too Early

The server is unwilling to risk processing a request that might be replayed (TLS 1.3 Early Data / 0-RTT).

4xx

426

Upgrade Required

The server refuses to perform the request using the current protocol, but may after the client upgrades.

4xx

428

Precondition Required

The origin server requires the request to be conditional to prevent the 'lost update' problem.

4xx

429

Too Many Requests

The user has sent too many requests in a given amount of time ('rate limiting').

4xx

431

Request Header Fields Too Large

The server refuses to process the request because its HTTP headers are too large (e.g. bloated cookies).

4xx

451

Unavailable For Legal Reasons

The server is denying access to the resource as a consequence of a legal demand (censorship, copyright, court order).

4xx

499

Client Closed RequestNginx

Nginx custom code indicating the client closed the connection before the server finished answering.

4xx

500

Internal Server Error

The server encountered an unexpected condition that prevented it from fulfilling the request.

5xx

501

Not Implemented

The server does not support the functionality required to fulfill the request.

5xx

502

Bad Gateway

The server, while acting as a gateway or proxy, received an invalid response from an inbound server.

5xx

503

Service Unavailable

The server is currently unable to handle the request due to temporary overloading or scheduled maintenance.

5xx

504

Gateway Timeout

The server, while acting as a gateway or proxy, did not receive a timely response from an upstream server.

5xx

505

HTTP Version Not Supported

The server does not support, or refuses to support, the major version of HTTP used in the request.

5xx

506

Variant Also Negotiates

Transparent content negotiation for the request results in a circular reference loop.

5xx

507

Insufficient StorageWebDAV

The method could not be performed on the resource because the server is unable to store the representation.

5xx

508

Loop DetectedWebDAV

The server terminated an operation because it encountered an infinite loop while processing a request.

5xx

510

Not Extended

Further extensions to the request are required for the server to fulfill it.

5xx

511

Network Authentication Required

The client needs to authenticate to gain network access (captive portal).

5xx

520

Web Server Returned an Unknown ErrorCloudflare / Edge

Cloudflare proxy received an empty, unexpected, or invalid response from the origin web server.

5xx

521

Web Server Is DownCloudflare / Edge

The origin web server refused the TCP connection from Cloudflare on the target port.

5xx

522

Connection Timed OutCloudflare / Edge

Cloudflare could not establish a TCP handshake with the origin server within 15 seconds.

5xx

523

Origin Is UnreachableCloudflare / Edge

Cloudflare was unable to reach the origin server through standard internet BGP routing.

5xx

524

A Timeout OccurredCloudflare / Edge

Cloudflare connected to origin, but origin did not send an HTTP response within 100 seconds.

5xx

525

SSL Handshake FailedCloudflare / Edge

Cloudflare could not perform a successful SSL/TLS handshake with the origin server.

5xx

526

Invalid SSL CertificateCloudflare / Edge

Cloudflare could not validate the SSL certificate on your origin web server in Full (Strict) mode.

5xx

401

Unauthorized

RFC 9110 §15.5.2·Series 4xx

Official Specification

The request has not been applied because it lacks valid authentication credentials for the target resource.

Cacheable by Default:No (Must not cache by default)

Response Body Allowed:Yes (Payload expected)

Common Production Root Causes

Missing Authorization header, expired JWT token, invalid API key.

Troubleshooting & Resolution Steps

Client must authenticate by sending 'Authorization: Bearer <token>' header.

Implementation / Diagnostic Snippet

// Express.js
res.status(401).set("WWW-Authenticate", "Bearer").json({ error: "Token expired" });

Capabilities

Key Features

Comprehensive RFC HTTP status code directory covering 1xx, 2xx, 3xx, 4xx, and 5xx series
Instant real-time search filtering by status code number, name, RFC specification, or keyword
Side-by-side 'Common Confusions' guides comparing 401 vs 403, 301 vs 302, and 502 vs 504
Detailed diagnostic cards explaining cacheability, response bodies, and browser behavior
Production troubleshooting checklists identifying common Nginx, Cloudflare, and CORS failures
Practical code snippets demonstrating implementation in Express.js, Fetch API, and Next.js
Color-coded response badges matching standard REST API conventions
100% client-side instant search with zero server roundtrips and zero tracking

Quick Guide

How to use

Search by code or symptom

Type a numeric status code (like 502 or 401) or a keyword (like 'timeout', 'redirect', or 'cors') into the search box.

Filter by status class

Switch category tabs between 1xx Informational, 2xx Success, 3xx Redirection, 4xx Client Error, or 5xx Server Error.

Inspect diagnostic troubleshooting details

Click any status code card to inspect its official RFC definition, cacheability, root causes, and resolution checklist.

Review implementation code snippets

Copy production code examples showing how to properly return or handle the status code in your frontend or backend API.

Technical Guide

About HTTP Status Code Diagnostic Explorer

HTTP Status Code Diagnostic Explorer is an interactive engineering reference and troubleshooting handbook for web developers, API architects, and DevOps professionals. Search through standard RFC HTTP response codes across 1xx (Informational), 2xx (Success), 3xx (Redirection), 4xx (Client Errors), and 5xx (Server Errors). Access in-depth diagnostic blueprints detailing cacheability semantics, common production root causes, and frontend/backend resolution steps.

FAQ

Frequently Asked Questions

HTTP 401 Unauthorized means 'Unauthenticated' — the client has not provided valid authentication credentials (like a missing or expired JWT/session cookie). HTTP 403 Forbidden means the client's identity is authenticated, but their account lacks permission/roles to access the requested resource.

Related Tools

Browse all

HTTP Status Code Diagnostic Explorer

Unauthorized

Key Features

How to use

Search by code or symptom

Filter by status class

Inspect diagnostic troubleshooting details

Review implementation code snippets

About HTTP Status Code Diagnostic Explorer

Frequently Asked Questions

Related Tools

URL & Query Parameter Inspector

Website Metadata Preview Builder

Smart Text Diff Checker

Unauthorized